在带有 ASOS 的 OpenID Connect 服务器中返回 401 响应

Question

I followed tutorial on Creating your own OpenID Connect server with ASOS . Everything works fine but in case user enters wrong credentials he will see 400 response status code. I would like to change this status code to 401. Here is code of my version of HandleTokenRequest function:

public override Task HandleTokenRequest(HandleTokenRequestContext context)
{
    if (context.Request.IsPasswordGrantType())
    {
        return GrantResourceOwnerCredentials(context);
    }
        return base.HandleTokenRequest(context);
}

private async Task GrantResourceOwnerCredentials(HandleTokenRequestContext context)
{
    var userService = context.HttpContext.RequestServices.GetService<IUserService>();

    var user = await userService.AuthenticateAsync(context.Request.Username, context.Request.Password);
    if (user != null)
    {
        var identity = CreatePrincipal(Mapper.Map<UserModel>(user), null);
        var ticket = new AuthenticationTicket(identity, new AuthenticationProperties(), context.Scheme.Name);
        ticket.SetScopes(Consts.Scopes.Api1, Consts.Scopes.ApiOfflineAccess);

        context.Validate(ticket);
        return;
    }
    context.Reject(error: "invalid_grant", description: "The user name or password is incorrect.");
}

I do not see how to pass response code here. Is it possible in this approach?

Answer 1

Making my comment an answer. From my experience, a 400 status code is very typical.

And it's also in the specification: https://openid.net/specs/openid-connect-core-1_0.html#TokenErrorResponse

If the Token Request is invalid or unauthorized, the Authorization Server constructs the error response. The parameters of the Token Error Response are defined as in Section 5.2 of OAuth 2.0 [RFC6749]. The HTTP response body uses the application/json media type with HTTP response code of 400.