{"action":"closed","number":83,"pull_request":{"url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/pulls/83","id":39390357,"html_url":"https://github.com/zfcampus/zf-mvc-auth/pull/83","diff_url":"https://github.com/zfcampus/zf-mvc-auth/pull/83.diff","patch_url":"https://github.com/zfcampus/zf-mvc-auth/pull/83.patch","issue_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/issues/83","number":83,"state":"closed","locked":false,"title":"Reply with 401 to requests with expired tokens","user":{"login":"weierophinney","id":25943,"avatar_url":"https://avatars.githubusercontent.com/u/25943?v=3","gravatar_id":"","url":"https://api.github.com/users/weierophinney","html_url":"https://github.com/weierophinney","followers_url":"https://api.github.com/users/weierophinney/followers","following_url":"https://api.github.com/users/weierophinney/following{/other_user}","gists_url":"https://api.github.com/users/weierophinney/gists{/gist_id}","starred_url":"https://api.github.com/users/weierophinney/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/weierophinney/subscriptions","organizations_url":"https://api.github.com/users/weierophinney/orgs","repos_url":"https://api.github.com/users/weierophinney/repos","events_url":"https://api.github.com/users/weierophinney/events{/privacy}","received_events_url":"https://api.github.com/users/weierophinney/received_events","type":"User","site_admin":false},"body":"As requested on IRC I'm opening this issue to discuss about which status should return when token is expired. \r\n\r\nRight now when a token has expired, GuestIdentity is assigned which will cause a 403. \r\n\r\nThe approach proposed by Matthew is to allow returning a 401 response from the authentication adapters. \r\n\r\nIn the oauth adapter in line [149](https://github.com/zfcampus/zf-mvc-auth/blob/master/src/Authentication/OAuth2Adapter.php#L149) we should add logic to verify if it has expired and in that case return 401.\r\n\r\nIn my opinion returning 401 is more descriptive and also helps the compatibility (out of scope of this library) with http interceptor plugins like [angular-http-auth](https://github.com/witoldsz/angular-http-auth) which right now won't queue unauthorized requests to re-send later like it does with 401.\r\n\r\nFrom [rfc6750](http://tools.ietf.org/html/rfc6750) page 8:\r\n\r\nError Codes\r\n\r\n   When a request fails, the resource server responds using the\r\n   appropriate HTTP status code (typically, 400, 401, 403, or 405) and\r\n   includes one of the following error codes in the response:\r\n\r\n   invalid_request\r\n         The request is missing a required parameter, includes an\r\n         unsupported parameter or parameter value, repeats the same\r\n         parameter, uses more than one method for including an access\r\n         token, or is otherwise malformed.  The resource server SHOULD\r\n         respond with the HTTP 400 (Bad Request) status code.\r\n\r\n   invalid_token\r\n         **The access token provided is expired, revoked, malformed, or\r\n         invalid for other reasons.  The resource SHOULD respond with\r\n         the HTTP 401 (Unauthorized) status code.  The client MAY\r\n         request a new access token and *retry* the protected resource\r\n         request.**\r\n\r\n   insufficient_scope\r\n         The request requires higher privileges than provided by the\r\n         access token.  The resource server SHOULD respond with the HTTP\r\n         403 (Forbidden) status code and MAY include the \"scope\"\r\n         attribute with the scope necessary to access the protected\r\n         resource.\r\n","created_at":"2015-07-07T16:36:16Z","updated_at":"2015-07-07T20:56:01Z","closed_at":"2015-07-07T20:56:01Z","merged_at":"2015-07-07T20:56:01Z","merge_commit_sha":"e4dfd4ce8282dd9af5047ac2c81c8a31c46b23fe","assignee":{"login":"weierophinney","id":25943,"avatar_url":"https://avatars.githubusercontent.com/u/25943?v=3","gravatar_id":"","url":"https://api.github.com/users/weierophinney","html_url":"https://github.com/weierophinney","followers_url":"https://api.github.com/users/weierophinney/followers","following_url":"https://api.github.com/users/weierophinney/following{/other_user}","gists_url":"https://api.github.com/users/weierophinney/gists{/gist_id}","starred_url":"https://api.github.com/users/weierophinney/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/weierophinney/subscriptions","organizations_url":"https://api.github.com/users/weierophinney/orgs","repos_url":"https://api.github.com/users/weierophinney/repos","events_url":"https://api.github.com/users/weierophinney/events{/privacy}","received_events_url":"https://api.github.com/users/weierophinney/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/milestones/12","html_url":"https://github.com/zfcampus/zf-mvc-auth/milestones/1.2.0","labels_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/milestones/12/labels","id":1187960,"number":12,"title":"1.2.0","description":null,"creator":{"login":"weierophinney","id":25943,"avatar_url":"https://avatars.githubusercontent.com/u/25943?v=3","gravatar_id":"","url":"https://api.github.com/users/weierophinney","html_url":"https://github.com/weierophinney","followers_url":"https://api.github.com/users/weierophinney/followers","following_url":"https://api.github.com/users/weierophinney/following{/other_user}","gists_url":"https://api.github.com/users/weierophinney/gists{/gist_id}","starred_url":"https://api.github.com/users/weierophinney/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/weierophinney/subscriptions","organizations_url":"https://api.github.com/users/weierophinney/orgs","repos_url":"https://api.github.com/users/weierophinney/repos","events_url":"https://api.github.com/users/weierophinney/events{/privacy}","received_events_url":"https://api.github.com/users/weierophinney/received_events","type":"User","site_admin":false},"open_issues":1,"closed_issues":1,"state":"open","created_at":"2015-06-30T20:48:51Z","updated_at":"2015-07-07T20:56:01Z","due_on":null,"closed_at":null},"commits_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/pulls/83/commits","review_comments_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/pulls/83/comments","review_comment_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/pulls/comments{/number}","comments_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/issues/83/comments","statuses_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/statuses/101feec0ec963726f7735c9daa23ba2904504d3b","head":{"label":"weierophinney:feature/83","ref":"feature/83","sha":"101feec0ec963726f7735c9daa23ba2904504d3b","user":{"login":"weierophinney","id":25943,"avatar_url":"https://avatars.githubusercontent.com/u/25943?v=3","gravatar_id":"","url":"https://api.github.com/users/weierophinney","html_url":"https://github.com/weierophinney","followers_url":"https://api.github.com/users/weierophinney/followers","following_url":"https://api.github.com/users/weierophinney/following{/other_user}","gists_url":"https://api.github.com/users/weierophinney/gists{/gist_id}","starred_url":"https://api.github.com/users/weierophinney/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/weierophinney/subscriptions","organizations_url":"https://api.github.com/users/weierophinney/orgs","repos_url":"https://api.github.com/users/weierophinney/repos","events_url":"https://api.github.com/users/weierophinney/events{/privacy}","received_events_url":"https://api.github.com/users/weierophinney/received_events","type":"User","site_admin":false},"repo":{"id":17872196,"name":"zf-mvc-auth","full_name":"weierophinney/zf-mvc-auth","owner":{"login":"weierophinney","id":25943,"avatar_url":"https://avatars.githubusercontent.com/u/25943?v=3","gravatar_id":"","url":"https://api.github.com/users/weierophinney","html_url":"https://github.com/weierophinney","followers_url":"https://api.github.com/users/weierophinney/followers","following_url":"https://api.github.com/users/weierophinney/following{/other_user}","gists_url":"https://api.github.com/users/weierophinney/gists{/gist_id}","starred_url":"https://api.github.com/users/weierophinney/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/weierophinney/subscriptions","organizations_url":"https://api.github.com/users/weierophinney/orgs","repos_url":"https://api.github.com/users/weierophinney/repos","events_url":"https://api.github.com/users/weierophinney/events{/privacy}","received_events_url":"https://api.github.com/users/weierophinney/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/weierophinney/zf-mvc-auth","description":"","fork":true,"url":"https://api.github.com/repos/weierophinney/zf-mvc-auth","forks_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/forks","keys_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/keys{/key_id}","collaborators_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/teams","hooks_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/hooks","issue_events_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/issues/events{/number}","events_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/events","assignees_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/assignees{/user}","branches_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/branches{/branch}","tags_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/tags","blobs_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/git/refs{/sha}","trees_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/git/trees{/sha}","statuses_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/statuses/{sha}","languages_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/languages","stargazers_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/stargazers","contributors_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/contributors","subscribers_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/subscribers","subscription_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/subscription","commits_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/commits{/sha}","git_commits_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/git/commits{/sha}","comments_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/comments{/number}","issue_comment_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/issues/comments{/number}","contents_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/contents/{+path}","compare_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/compare/{base}...{head}","merges_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/merges","archive_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/downloads","issues_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/issues{/number}","pulls_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/pulls{/number}","milestones_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/milestones{/number}","notifications_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/labels{/name}","releases_url":"https://api.github.com/repos/weierophinney/zf-mvc-auth/releases{/id}","created_at":"2014-03-18T16:01:46Z","updated_at":"2014-03-26T17:31:32Z","pushed_at":"2015-07-07T20:55:39Z","git_url":"git://github.com/weierophinney/zf-mvc-auth.git","ssh_url":"git@github.com:weierophinney/zf-mvc-auth.git","clone_url":"https://github.com/weierophinney/zf-mvc-auth.git","svn_url":"https://github.com/weierophinney/zf-mvc-auth","homepage":null,"size":500,"stargazers_count":0,"watchers_count":0,"language":"PHP","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"zfcampus:develop","ref":"develop","sha":"8cd07f67cc843269d4dd2639e13529516e0f39e3","user":{"login":"zfcampus","id":5454933,"avatar_url":"https://avatars.githubusercontent.com/u/5454933?v=3","gravatar_id":"","url":"https://api.github.com/users/zfcampus","html_url":"https://github.com/zfcampus","followers_url":"https://api.github.com/users/zfcampus/followers","following_url":"https://api.github.com/users/zfcampus/following{/other_user}","gists_url":"https://api.github.com/users/zfcampus/gists{/gist_id}","starred_url":"https://api.github.com/users/zfcampus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zfcampus/subscriptions","organizations_url":"https://api.github.com/users/zfcampus/orgs","repos_url":"https://api.github.com/users/zfcampus/repos","events_url":"https://api.github.com/users/zfcampus/events{/privacy}","received_events_url":"https://api.github.com/users/zfcampus/received_events","type":"Organization","site_admin":false},"repo":{"id":13747507,"name":"zf-mvc-auth","full_name":"zfcampus/zf-mvc-auth","owner":{"login":"zfcampus","id":5454933,"avatar_url":"https://avatars.githubusercontent.com/u/5454933?v=3","gravatar_id":"","url":"https://api.github.com/users/zfcampus","html_url":"https://github.com/zfcampus","followers_url":"https://api.github.com/users/zfcampus/followers","following_url":"https://api.github.com/users/zfcampus/following{/other_user}","gists_url":"https://api.github.com/users/zfcampus/gists{/gist_id}","starred_url":"https://api.github.com/users/zfcampus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zfcampus/subscriptions","organizations_url":"https://api.github.com/users/zfcampus/orgs","repos_url":"https://api.github.com/users/zfcampus/repos","events_url":"https://api.github.com/users/zfcampus/events{/privacy}","received_events_url":"https://api.github.com/users/zfcampus/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/zfcampus/zf-mvc-auth","description":"","fork":false,"url":"https://api.github.com/repos/zfcampus/zf-mvc-auth","forks_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/forks","keys_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/keys{/key_id}","collaborators_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/teams","hooks_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/hooks","issue_events_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/issues/events{/number}","events_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/events","assignees_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/assignees{/user}","branches_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/branches{/branch}","tags_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/tags","blobs_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/git/refs{/sha}","trees_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/git/trees{/sha}","statuses_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/statuses/{sha}","languages_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/languages","stargazers_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/stargazers","contributors_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/contributors","subscribers_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/subscribers","subscription_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/subscription","commits_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/commits{/sha}","git_commits_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/git/commits{/sha}","comments_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/comments{/number}","issue_comment_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/issues/comments{/number}","contents_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/contents/{+path}","compare_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/compare/{base}...{head}","merges_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/merges","archive_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/downloads","issues_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/issues{/number}","pulls_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/pulls{/number}","milestones_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/milestones{/number}","notifications_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/labels{/name}","releases_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/releases{/id}","created_at":"2013-10-21T16:06:11Z","updated_at":"2015-07-07T11:32:09Z","pushed_at":"2015-07-07T20:56:01Z","git_url":"git://github.com/zfcampus/zf-mvc-auth.git","ssh_url":"git@github.com:zfcampus/zf-mvc-auth.git","clone_url":"https://github.com/zfcampus/zf-mvc-auth.git","svn_url":"https://github.com/zfcampus/zf-mvc-auth","homepage":null,"size":1074,"stargazers_count":27,"watchers_count":27,"language":"PHP","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":35,"mirror_url":null,"open_issues_count":13,"forks":35,"open_issues":13,"watchers":27,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/zfcampus/zf-mvc-auth/pulls/83"},"html":{"href":"https://github.com/zfcampus/zf-mvc-auth/pull/83"},"issue":{"href":"https://api.github.com/repos/zfcampus/zf-mvc-auth/issues/83"},"comments":{"href":"https://api.github.com/repos/zfcampus/zf-mvc-auth/issues/83/comments"},"review_comments":{"href":"https://api.github.com/repos/zfcampus/zf-mvc-auth/pulls/83/comments"},"review_comment":{"href":"https://api.github.com/repos/zfcampus/zf-mvc-auth/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/zfcampus/zf-mvc-auth/pulls/83/commits"},"statuses":{"href":"https://api.github.com/repos/zfcampus/zf-mvc-auth/statuses/101feec0ec963726f7735c9daa23ba2904504d3b"}},"merged":true,"mergeable":null,"mergeable_state":"unknown","merged_by":{"login":"weierophinney","id":25943,"avatar_url":"https://avatars.githubusercontent.com/u/25943?v=3","gravatar_id":"","url":"https://api.github.com/users/weierophinney","html_url":"https://github.com/weierophinney","followers_url":"https://api.github.com/users/weierophinney/followers","following_url":"https://api.github.com/users/weierophinney/following{/other_user}","gists_url":"https://api.github.com/users/weierophinney/gists{/gist_id}","starred_url":"https://api.github.com/users/weierophinney/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/weierophinney/subscriptions","organizations_url":"https://api.github.com/users/weierophinney/orgs","repos_url":"https://api.github.com/users/weierophinney/repos","events_url":"https://api.github.com/users/weierophinney/events{/privacy}","received_events_url":"https://api.github.com/users/weierophinney/received_events","type":"User","site_admin":false},"comments":3,"review_comments":3,"commits":2,"additions":331,"deletions":10,"changed_files":5}}