search

Brightspace / D2L.Security.OAuth2

Brightspace OAuth 2.0 for C#
Apache License 2.0
7 stars 16 forks source link

Move AuthenticateAs extension from HttpClient to HttpRequestMessage to avoid dangerous usage patterns #17

Closed j3parker closed 8 years ago

j3parker commented 8 years ago

https://github.com/Brightspace/D2L.Security.OAuth2/blob/2fcedbf1f9d816b2125bece64f64acee7f9bd1e9/src/D2L.Security.OAuth2/Extensions/System.Net.Http.HttpClient.Extensions.cs#L15

Using DefaultRequestHeaders means that if an HttpClient is reused the tokens will get sent which is quite possibly undesirable.