search

apigee / openbank

An Open Banking Reference Implementation with Apigee
https://apigee.github.io/openbank
Apache License 2.0
132 stars 91 forks source link

Client Credentials Grant Type should also support Basic Authentication. EDIT - handling missing Content-Type header #55

Closed seantdg closed 5 years ago

seantdg commented 7 years ago

Many PSPs will only support Basic Authentication for the Client Credentials grant type /token call, instead of a client assertion.

Could we support this too? Currently if I pass a normal /token request with client credentials, the refresh token policy is hit instead of an error.

rohan-m commented 7 years ago

@seantdg Both basic authentication and client assertion are supported. Currently if you pass basic auth, it should generate access token and not produce error. Looks like a policy in the flow is missed and refresh token is hit directly in your scenario.. Can you provide the error you are facing with more detail?

seantdg commented 7 years ago

my mistake! this occurs if the Content-Type header isn't set correctly. We should either assume a Content-Type of "application/x-www-form-urlencoded" if a Content-Type isn't set, or throw an error rather than assuming refresh token.

laughingbiscuit commented 5 years ago

Closing as the project has been refactored and this bug issue no longer applies - please see https://github.com/apigee/openbank#previous-versions