A client must use their client_secret if they have one

aliev / aioauth

Asynchronous OAuth 2.0 provider for Python 3

https://aliev.me/aioauth

MIT License

214 stars 19 forks source link

A client must use their client_secret if they have one #80

Closed tdg5 closed 1 year ago

tdg5 commented 1 year ago

I realized that some of the tests I'd changed/added should have failed when a client with a client_secret tried to use the password grant without their client_secret. This fixes the related bug and the tests that should have been broken.

Not sure if there's an easier way to build a server with custom settings, but I thought this approach was pretty clean.

aliev commented 1 year ago

@tdg5 can we already merge this pr?

tdg5 commented 1 year ago

@aliev yes, please.