lepture / authlib

The ultimate Python library in building OAuth, OpenID Connect clients and servers. JWS,JWE,JWK,JWA,JWT included.
https://authlib.org/
BSD 3-Clause "New" or "Revised" License
4.58k stars 458 forks source link

OAuth2Request should access `grant_type` through `data` #651

Closed apvd closed 4 months ago

apvd commented 6 months ago

The grant_type property of the OAuth2Request class should refer to the data collection (consistent with the other properties response_type, client_id, etc. and not through the base form. Without this change the following grant setting will not function:

TOKEN_ENDPOINT_HTTP_METHODS = ["GET"]

What kind of change does this PR introduce? (check at least one)

Does this PR introduce a breaking change? (check one)


codespearhead commented 4 months ago

I'd argue that's by design, as stated here: https://github.com/lepture/authlib/issues/658 .

apvd commented 4 months ago

RFC frowns upon GET requests for token endpoint. https://datatracker.ietf.org/doc/html/rfc6749#section-3.2