search

golang / oauth2

Go OAuth2
https://golang.org/x/oauth2
BSD 3-Clause "New" or "Revised" License
5.38k stars 991 forks source link

Ability to provide empty redirect_uri when exchanging token #121

Closed sebcante closed 1 year ago

sebcante commented 9 years ago

hi guys,

When using Facebook signed request to exchange a code coming from the client side (Facebook JS SDK) for a token, we would need to specify an empty redirect_uri. I tried to set config.RedirectURL = "" but it does not seem to be sent as empty to the oauth server but rather it does not seem to be sent at all.

Received error code : Response: {"error":{"message":"Missing redirect_uri parameter.","type":"OAuthException","code":191}}

Would there be a way to force sending redirect_urias empty string when calling config.Exchange()?

This behaviour was documented here thanks to the folks from omniauth https://github.com/mkdynamic/omniauth-facebook/blob/master/lib/omniauth/strategies/facebook.rb#L79

thanks

-seb

adg commented 9 years ago

Yay, another spec violation. There's no way to do this currently. I'm not too keen on putting options in the oauth2 package to make this possible. Can you file a bug with Facebook?

sebcante commented 9 years ago

Thanks andrew for the quick feedback, i tried my luck filing a bug to facebook https://developers.facebook.com/bugs/838192036274549/ , let see how it goes, i will report back here is FB is ok to change anything on their side. In the mean time i will have to fork to change func (c *Config) Exchange(ctx context.Context, code string) and replace 

"redirect_uri": internal.CondVal(c.RedirectURL),

with

"redirect_uri": []string{c.RedirectURL},
adg commented 9 years ago

Thanks for filing that bug. I've subscribed to the report to see what they say.

Yeah, please use your fork until we hear back from FB. I'm loathe to put in workarounds for every broken oauth2 endpoint out there.