🔐(backend) avoids revealing the inactive status of an application

Authenticate the application secret before checking whether the
application is inactive.

This avoids revealing the inactive status of an application when
an incorrect secret is provided, preventing an authentication
state oracle and client_id enumeration.

CHANGELOG.md

@@ -25,6 +25,7 @@ and this project adheres to
 - 🌐(frontend) improve German translation #1125
 - 🔨(python-env) migrate meet main app to UV #1120
 - ♻️(backend) align Application model field with `is_active` convention #1133
+- 🔐(backend) avoids revealing the inactive status of an application #1135
 
 ### Fixed
 

src/backend/core/external_api/viewsets.py

@@ -61,12 +61,12 @@ class ApplicationViewSet(viewsets.ViewSet):
         except models.Application.DoesNotExist as e:
             raise drf_exceptions.AuthenticationFailed("Invalid credentials") from e
 
-        if not application.is_active:
-            raise drf_exceptions.AuthenticationFailed("Application is inactive")
-
         if not check_password(client_secret, application.client_secret):
             raise drf_exceptions.AuthenticationFailed("Invalid credentials")
 
+        if not application.is_active:
+            raise drf_exceptions.AuthenticationFailed("Application is inactive")
+
         email = serializer.validated_data["scope"]
         try:
             validate_email(email)