mirror of
https://github.com/OAuthSwift/OAuthSwift.git
synced 2026-04-26 20:55:57 +03:00
[GH-ISSUE #574] Remove client_key and client_secret from body when accessTokenBasicAuthentification is enabled #375
Labels
No labels
bug
cocoapod
duplicate
enhancement
feature-request
help wanted
help wanted
invalid
pull-request
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/OAuthSwift#375
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @trentbb on GitHub (Feb 11, 2020).
Original GitHub issue: https://github.com/OAuthSwift/OAuthSwift/issues/574
Description:
Recently ran in to an issue trying to obtain a token. A particular provider I am using requires using Basic Authentication to provide the client_key and client_secret. So, I'm setting the accessTokenBasicAuthentification to true, and this mostly works. However I run into a problem with OAuthSwift leaving the client_ and client_secret in the body params. The provider will not accept the request if the client key and secret are in both the body and header. I've never run into this with any other provider, so I think that the provider I am using is just a bit odd. I think it makes since to me that if you're going to include the client key and secret in the header, then it shouldn't be in the body too. Either or.
OAuth Provider? (Twitter, Github, ..):
ForgeRock
OAuth Version:
OS (Please fill the version) :
Installation method:
Library version:
Xcode version:
[x ] 11.x (Swift 5.1)
10.x (Swift 5.0)
10.x (Swift 4.1)
9.3 (Swift 4.1)
9.0 (Swift 4.0)
other: (Please fill in the version you are using.)
objective c
@phimage commented on GitHub (Apr 30, 2020):
@trentbb did you think client_id too, not only secret?
to test you could add a boolean
doNotSendClientInfoInBodyin OAuth2Swift.swiftthen here
github.com/OAuthSwift/OAuthSwift@fde77955e6/Sources/OAuth2Swift.swift (L177)and maybe also here
github.com/OAuthSwift/OAuthSwift@fde77955e6/Sources/OAuth2Swift.swift (L168)do not set info in parameters if your boolean is true
@trentbb commented on GitHub (Apr 30, 2020):
@phimage Thanks for your response. I ended up forking OAuthSwift and made similar changes to what you just described
github.com/trentbb/OAuthSwift@deb08836a4@phimage commented on GitHub (May 2, 2020):
I will close. Anybody could feel free to PR this change as optional feature