OAuth2_GrantType_AuthorizationCode should expect POST parameters, not GET

[bshaffer]

OAuth2_GrantType_AuthorizationCode should expect POST parameters, not GET

[ccazette]

After more code and specs reading, I confirm this is an issue.

The library expects query parameters (see OAuth2_GrantType_AuthorizationCode::validateRequest(), OAuth2_GrantType_AuthorizationCode::getTokenDataFromRequest()) when it should come in POST parameters (see http://tools.ietf.org/html/draft-ietf-oauth-v2-31#section-4.1.1)

[ccazette]

OK... This will sound ridiculous, now I've closed this by myself 2 times already, but now I definitely think this is an issue. Was linking to the wrong section of the specs.

Here's the issue :

• specs expects POST from client : http://tools.ietf.org/html/draft-ietf-oauth-v2-31#section-4.1.3
• lib validates agains GET : OAuth2_GrantType_AuthorizationCode::validateRequest(), OAuth2_GrantType_AuthorizationCode::getTokenDataFromRequest()

This is my last word :)

[asherkin]

I've just ran into this as well.

[bshaffer]

I agree this is an issue. I will fix ASAP!

[ccazette]

Note that OAuth2_GrantType_UserCredentials also expects GET, when it should expect POST.
http://tools.ietf.org/html/draft-ietf-oauth-v2-31#section-4.3.2

[ccazette]

That also applies to OAuth2_GrantType_RefreshToken.
http://tools.ietf.org/html/draft-ietf-oauth-v2-31#section-6

[bshaffer]

I think this paragraph says everything we need to know:

The client MUST use the HTTP "POST" method when making access token
requests.

http://tools.ietf.org/html/draft-ietf-oauth-v2-31#section-3.2

[ccazette]

haha :)
good catch...