diff --git a/src/Grant/RefreshTokenGrant.php b/src/Grant/RefreshTokenGrant.php old mode 100644 new mode 100755 index b6302bca5..94e91ccdf --- a/src/Grant/RefreshTokenGrant.php +++ b/src/Grant/RefreshTokenGrant.php @@ -42,8 +42,15 @@ public function respondToAccessTokenRequest( ResponseTypeInterface $responseType, DateInterval $accessTokenTTL ) { - // Validate request - $client = $this->validateClient($request); + list($clientId) = $this->getClientCredentials($request); + + $client = $this->getClientEntityOrFail($clientId, $request); + + // Only validate the client if it is confidential + if ($client->isConfidential()) { + $this->validateClient($request); + } + $oldRefreshToken = $this->validateOldRefreshToken($request, $client->getIdentifier()); $scopes = $this->validateScopes($this->getRequestParameter( 'scope',