allow token parameter from the POST body

services/auth/oauth2.go

@@ -63,6 +63,14 @@ func (o *OAuth2) Name() string {
 // representing whether the token exists or not
 func parseToken(req *http.Request) (string, bool) {
 	_ = req.ParseForm()
+
+	// attempt to read the token from the POST body, which does not pose a security issue
+	// and is mandated for certain flows like OIDC introspection:
+	// https://datatracker.ietf.org/doc/html/rfc7662#section-2.1
+	if token := req.PostForm.Get("token"); token != "" {
+		return token, true
+	}
+
 	if !setting.DisableQueryAuthToken {
 		// Check token.
 		if token := req.Form.Get("token"); token != "" {

tests/integration/oauth_test.go

@@ -419,3 +419,40 @@ func TestRefreshTokenInvalidation(t *testing.T) {
 	assert.Equal(t, "unauthorized_client", string(parsedError.ErrorCode))
 	assert.Equal(t, "token was already used", parsedError.ErrorDescription)
 }
+
+func TestOAuthIntrospection(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+	req := NewRequestWithValues(t, "POST", "/login/oauth/access_token", map[string]string{
+		"grant_type":    "authorization_code",
+		"client_id":     "da7da3ba-9a13-4167-856f-3899de0b0138",
+		"client_secret": "4MK8Na6R55smdCY0WuCCumZ6hjRPnGY5saWVRHHjJiA=",
+		"redirect_uri":  "a",
+		"code":          "authcode",
+		"code_verifier": "N1Zo9-8Rfwhkt68r1r29ty8YwIraXR8eh_1Qwxg7yQXsonBt",
+	})
+	resp := MakeRequest(t, req, http.StatusOK)
+	type response struct {
+		AccessToken  string `json:"access_token"`
+		TokenType    string `json:"token_type"`
+		ExpiresIn    int64  `json:"expires_in"`
+		RefreshToken string `json:"refresh_token"`
+	}
+	parsed := new(response)
+
+	assert.NoError(t, json.Unmarshal(resp.Body.Bytes(), parsed))
+	assert.True(t, len(parsed.AccessToken) > 10)
+	assert.True(t, len(parsed.RefreshToken) > 10)
+
+	req = NewRequestWithValues(t, "POST", "/login/oauth/introspect", map[string]string{
+		"token": parsed.AccessToken,
+	})
+	req.Header.Add("Authorization", "Basic ZGE3ZGEzYmEtOWExMy00MTY3LTg1NmYtMzg5OWRlMGIwMTM4OjRNSzhOYTZSNTVzbWRDWTBXdUNDdW1aNmhqUlBuR1k1c2FXVlJISGpKaUE9")
+	resp = MakeRequest(t, req, http.StatusOK)
+	type introspectResponse struct {
+		Active bool   `json:"active"`
+		Scope  string `json:"scope,omitempty"`
+	}
+	introspectParsed := new(introspectResponse)
+	assert.NoError(t, json.Unmarshal(resp.Body.Bytes(), introspectParsed))
+	assert.True(t, introspectParsed.Active)
+}