fix(bug): Skip session assurance check in /oauth/token route

mozilla · Oct 31, 2024 · f9f8e66 · f9f8e66
1 parent 88c2401
commit f9f8e66
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/packages/fxa-auth-server/lib/routes/oauth/token.js b/packages/fxa-auth-server/lib/routes/oauth/token.js
@@ -446,7 +446,7 @@ module.exports = ({ log, oauthDB, db, mailer, devices, statsd, glean }) => {
           // XXX TODO: To be able to fully replace the /token route from oauth-server,
           // this route must also be able to accept 'client_secret' as Basic Auth in header.
           mode: 'optional',
-          strategy: 'sessionToken',
+          strategy: 'sessionTokenNoAssurance',
         },
         validate: {
           // Note: the use of 'alternatives' here means that `grant_type` will default to