-
-
Notifications
You must be signed in to change notification settings - Fork 495
Description
Describe the bug
oauthlib==3.3.0
raises ValueError: expires_int must be an int
inside oauthlib.oauth2.rfc6749.parameters.parse_expires()
whenever the access-token dict contains an expires_in
value that is not already an int
.
Many real-world providers (Google, Azure AD, GitLab, Reddit, …) return "expires_in": "3599"
(a JSON string), and earlier oauthlib versions silently coerced this to int
.
The change shipped in 3.3.0 breaks every downstream library that passes the raw token through, e.g. requests-oauthlib
, Flask-Dance
, Azure’s msrest
, etc. example: Azure/azure-sdk-for-python#41635
How to reproduce
# works on 3.2.2, crashes on 3.3.0
from oauthlib.oauth2 import WebApplicationClient
WebApplicationClient(
client_id="dummy",
token={"access_token": "xyz", "expires_in": "3600"} # ← str on purpose
)
Additional context
• OAuth version: OAuth 2 (authorization-code & installed-app flows)
• Code type: Client
• Provider(s): Google, Azure AD, GitLab, Reddit (all return expires_in as JSON string)
A simple pin to oauthlib==3.2.2 restores functionality, so this appears to be a regression introduced in 3.3.0’s new type-check logic in parse_expires().