search

cmd-johnson / deno-oauth2-client

Minimalistic OAuth 2.0 client for Deno.
MIT License
45 stars 9 forks source link

Question: what if `token_type` is not always available #37

Open pixeleet opened 11 months ago

pixeleet commented 11 months ago

E.g. LinkedIn OAuth doesn't send the token_type in the response. https://learn.microsoft.com/en-us/linkedin/shared/authentication/authorization-code-flow?tabs=HTTPS1#response

Thus the getToken flow is erroring out. https://github.com/cmd-johnson/deno-oauth2-client/blob/master/src/grant_base.ts#L99-L104

cmd-johnson commented 11 months ago

Ugh, I just love how hard it seems to be for authorization servers to properly implement the OAuth2 standard :sweat_smile:

The OAuth2 spec requires the token response to have this field, so this is technically a bug on LinkedIn's side.

Still, I'm aware that there's a lot of implementations out there that don't follow the spec and I'll try to come up with a way to account for these discrepancies that doesn't require everyone to reinvent the wheel in the process.

pixeleet commented 11 months ago

Tbh I haven't managed to auth with an OAuth based service yet that didn't use a Bearer token. Would it be safe to default token_type to Bearer if not present?

pixeleet commented 11 months ago

Let the title represent it's LinkedIn's bug not the library's and we're questioning the problem to achieve a solution.

iuioiua commented 5 months ago

We've run into this issue in https://github.com/denoland/deno_kv_oauth/pull/287. @cmd-johnson, is there any workaround?

Edit: Nevermind. We're getting a Client authentication failed error. It appears to be yet another bug on LinkedIn's side: https://github.com/nextauthjs/next-auth/issues/8831