Skip to content

Issue with version 3.3.0 and other libraries #906

@nodiz

Description

@nodiz

Describe the bug

oauthlib==3.3.0 raises ValueError: expires_int must be an int inside oauthlib.oauth2.rfc6749.parameters.parse_expires() whenever the access-token dict contains an expires_in value that is not already an int.
Many real-world providers (Google, Azure AD, GitLab, Reddit, …) return "expires_in": "3599" (a JSON string), and earlier oauthlib versions silently coerced this to int.
The change shipped in 3.3.0 breaks every downstream library that passes the raw token through, e.g. requests-oauthlib, Flask-Dance, Azure’s msrest, etc. example: Azure/azure-sdk-for-python#41635


How to reproduce

# works on 3.2.2, crashes on 3.3.0
from oauthlib.oauth2 import WebApplicationClient

WebApplicationClient(
    client_id="dummy",
    token={"access_token": "xyz", "expires_in": "3600"}  # ← str on purpose
)

Additional context
• OAuth version: OAuth 2 (authorization-code & installed-app flows)
• Code type: Client
• Provider(s): Google, Azure AD, GitLab, Reddit (all return expires_in as JSON string)

A simple pin to oauthlib==3.2.2 restores functionality, so this appears to be a regression introduced in 3.3.0’s new type-check logic in parse_expires().

Metadata

Metadata

Assignees

No one assigned

    Labels

    BugOAuth2-ClientThis impact the client part of OAuth2.

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions