Open PrometheusSatyen opened 6 years ago
Can you not instead first use the client ID to test sending a faked code
value to /oauth/token
? Or does that not return anything about invalid client ID?
If it does detail bad client ID & secret values before considering the code
value, you can use this test before you redirect users to SSO for the same app.
Feature / Modification Request
Description
Currently if you visit an invalid SSO url such as: https://login.eveonline.com/oauth/authorize?response_type=code&redirect_uri=eveauth-cerebral%3A%2F%2Fcallback&client_id=3e601&scope=esi-location.read_location.v1&state=login
If no character is logged in, the login screen will load despite the totally invalid client id. Only after logging in will an error then be displayed (as a JSON body returned with an error property)
I would like this altered so that the error is received even if no user is logged in.
Use case
My desktop app has to prompt for users to generate and enter a client ID/secret so that I don't have to bake the secret into the binary. It would be helpful if I could easily test the entered client ID by firing off a GET request and seeing what comes back.