OAuth2 introspect endpoint is not conforming with RFC 7662 standard and sometimes has invalid json

[danmana]

As stated in the developer documentation and in the swagger definition the https://api.fitbit.com/oauth2/introspect endpoint should conform to the RFC 7662 specification.

The API has the following diferences from the spec:

1. content type is application/octet-stream instead of application/json (regardless of any Accept request ehader)- see spec
2. "active" field is not a boolean, but a truthy value 1/0 - see spec

Additionally the endpoint sometimes returns invalid json.

- on 19 Apr 2018, out of 16 tokens tested, 6 returned invalid json - the json was prefixed with either ":" or ","

- today, 23 Apr, it seems that all calls return valid json

Example of bad json response (client/user ids redacted by me)

Response 1:
HTTP/1.1 200 OK

Headers: 
X-Frame-Options=SAMEORIGIN
Date=Thu, 19 Apr 2018 15:26:42 GMT
Content-Length=283
Fitbit-Rate-Limit-Limit=150
Fitbit-Rate-Limit-Remaining=150
Fitbit-Rate-Limit-Reset=1998
CF-RAY=40e064190f1f2774-FRA
Content-Type=application/octet-stream
Connection=keep-alive
Server=cloudflare
Expect-CT=max-age=604800
report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"

Body:
,{"active":1,"scope":"{SOCIAL=READ_WRITE, SETTINGS=READ_WRITE, SLEEP=READ_WRITE, ACTIVITY=READ_WRITE, NUTRITION=READ_WRITE, PROFILE=READ_WRITE, WEIGHT=READ_WRITE}","clientId":{"id":"<redacted>"},"userId":{"id":"<redacted>"},"tokenType":"access_token","exp":1524179695000,"iat":1524150895000}



Response 2:
HTTP/1.1 200 OK

Headers:
X-Frame-Options=SAMEORIGIN
Date=Thu, 19 Apr 2018 15:26:45 GMT
Content-Length=326
Fitbit-Rate-Limit-Limit=150
Fitbit-Rate-Limit-Remaining=150
Fitbit-Rate-Limit-Reset=1995
CF-RAY=40e0642b189f2774-FRA
Content-Type=application/octet-stream
Connection=keep-alive
Server=cloudflare
Expect-CT=max-age=604800
report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"}}

Body:
:{"active":1,"scope":"{SOCIAL=READ_WRITE, SETTINGS=READ_WRITE, HEARTRATE=READ_WRITE, SLEEP=READ_WRITE, ACTIVITY=READ_WRITE, LOCATION=READ_WRITE, NUTRITION=READ_WRITE, PROFILE=READ_WRITE, WEIGHT=READ_WRITE}","clientId":{"id":"<redacted>"},"userId":{"id":"<redacted>"},"tokenType":"access_token","exp":1524179699000,"iat":1524150899000}

It looks like the response json is truncated from a larger json array/map.

I'm not sure if this could be exploited to reveal other user tokens or not.