Closed neoneye closed 6 years ago
@neoneye If you take a look at https://tools.ietf.org/html/rfc6749#section-6, it does require an authorization header in the rfc IF the client was issued client credentials (which means, you HAVE a client_secret and not only a client_id, correct me if I'm wrong). So I think this is the correct behavior by oauthSwift.
This is the original wording in the rfc for refreshing an access token:
If the client type is confidential or the client was issued client credentials (or assigned other authentication requirements), the client MUST authenticate with the authorization server
@Germandrummer92 ok, thank you for answering this. I have forwarded your answer to my backend developer friend.
Thank you for a great framework.
I think there is a problem with
OAuthSwift2RequestAdapter.refreshTokens()
. Currently anAuthorization
header is inserted in therefresh_token
request.However none of the RFC examples show an
Authorization
header.This is causing me problems. The server rejects my attempt at refreshing, because the
access_token
is expired. I have made a workaround, but I would very much prefer that this got fixed in OAuthSwiftAlamofire.Here are examples of the
refresh_token
request: https://tools.ietf.org/html/rfc6749#page-17 https://tools.ietf.org/html/rfc6749#page-47The RFC doesn't mention if the
Authorization
header is optional in therefresh_token
request. I'm unsure if it's allowed. I think theAuthorization
header shouldn't be there. Forgive me if I'm wrong about this.I have made 2 workarounds.
Current behavior
Here the request has an
Authorization
header.Request
Response
New behavior with workaround
Here the request is without the
Authorization
header.Request
Response
Workaround A
Workaround B