Why did you send client_secret in Authorization code grant type?

FrankHassanabad / Oauth2orizeRecipes

OAuth2 security recipes and examples based on OAuth2orize

MIT License

375 stars 97 forks source link

Why did you send client_secret in Authorization code grant type? #72

Open elainegasca opened 5 years ago

elainegasca commented 5 years ago

This broken Authorization Code flow, because you cannot keep client_secret credential safe in the client, so.. why in your demo example (authorization code) did you send in the body request (x-www-form-urlencoded) the client_secret field or I mistaken.

Regards