HeroicKatora / oxide-auth

A OAuth2 server library, for use in combination with actix or other frontends, featuring a set of configurable and pluggable backends.
685 stars 91 forks source link

Content-Type in token reauests #160

Open marekvospel opened 1 year ago

marekvospel commented 1 year ago

Feature

I've been trying this library out yesterday, but after setting up something simillar to the examples, I started making requests, but evey single one was invalid, because i used application/json content type instead of application/x-www-form-urlencoded (Reading the source code I noticed it isn't even checked (At least in case of rocket frontend) and is automatically decoded with serde_urlform.

Yes, the OAuth2 specification doesn't mention JSON content type in the requests, but it has become common to also allow JSON, (Before reading some parts of the specs, I didn't even know JSON isn't the default for OAuth2.) so I belive it should be supported, or at least an option to use custom Content-Type could be added.

Alternatives

Because this is an extra feature on top of the OAuth2 spec, I think it would need to be an additional feature. Alternatively (at least in the case of rocket frontend) the Data inside OAuthRequest could be an enum of different grant types (and their data inside), and an additional method could be added, to let users parse the body on their own.

Context

https://github.com/HeroicKatora/oxide-auth/blob/master/oxide-auth-rocket/src/lib.rs#L97

Tracking pull request