Ignore blank entries in the prompt parameter

[55728]

Summary

oidc_prompt_values splits the space-delimited prompt parameter with split(/ +/). A value with leading (or otherwise stray) whitespace, e.g. prompt=%20none, produces an empty-string element:

" none".split(/ +/) # => ["", "none"]

The empty string then falls through handle_oidc_prompt_param!'s case to the else branch (and trips handle_oidc_prompt_none!'s "another value present" guard), so the request is rejected with invalid_request instead of being treated as prompt=none.

Fix

Reject blank entries after splitting:

params[:prompt].to_s.split(/ +/).reject(&:blank?).uniq

Only the empty-string case changes; valid prompts are unaffected.

Diff

diff --git a/lib/doorkeeper/openid_connect/helpers/controller.rb b/lib/doorkeeper/openid_connect/helpers/controller.rb
@@ -176,7 +176,11 @@ module Doorkeeper
         def oidc_prompt_values
-          @oidc_prompt_values ||= params[:prompt].to_s.split(/ +/).uniq
+          # Reject blank entries so leading/duplicate spaces in the
+          # space-delimited `prompt` parameter don't surface as an empty
+          # value (which would otherwise be treated as an unknown prompt and
+          # rejected with `invalid_request`).
+          @oidc_prompt_values ||= params[:prompt].to_s.split(/ +/).reject(&:blank?).uniq
         end

A spec was added asserting prompt: " none" (leading whitespace) auto-issues like prompt: "none".

Verification

• bundle exec rspec spec/controllers/doorkeeper/authorizations_controller_spec.rb → 73 examples, 0 failures
• Full suite → 286 examples, 0 failures
• bundle exec rubocop <changed files> → no offenses

[Copilot]

Pull request overview

This pull request fixes OpenID Connect prompt parameter parsing so that leading (and other stray) spaces don’t introduce an empty-string prompt value that is incorrectly treated as an unknown prompt and rejected with invalid_request.

Changes:

• Filter out blank entries from the space-delimited prompt parameter before applying prompt handling logic.
• Add a controller spec asserting that prompt: " none" behaves like prompt: "none" (auto-issues when a matching token exists).
• Document the fix in the Unreleased changelog.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
lib/doorkeeper/openid_connect/helpers/controller.rb	Updates oidc_prompt_values to reject blank prompt entries after splitting.
spec/controllers/doorkeeper/authorizations_controller_spec.rb	Adds coverage for leading whitespace in prompt when using prompt=none.
CHANGELOG.md	Notes the behavioral fix under Unreleased.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[nbulaj]

✅