nxtbgthng / OAuth2Client

Client library for OAuth2 (currently built against draft 10 of the OAuth2 spec)
855 stars 217 forks source link

Custom header fields not applied to token refresh request #206

Open mattreagan29 opened 8 years ago

mattreagan29 commented 8 years ago

NXOAuth throws a warning to the console anytime it attempts to submit a POST request of type multi-part (Stream has been reopened after close).

Unfortunately by default, in NXOAuth2Connection - (void)applyParameters:(NSDictionary *)parameters onRequest:(NSMutableURLRequest *)aRequest;, all POST requests default to multi-part, rather than application/x-www-form-urlencoded.

In some scenarios you can work around this by setting a custom Content-type header, via the configuration dictionary key kNXOAuth2AccountStoreConfigurationCustomHeaderFields. This loads the custom Content-Type header into the oauthClient's customHeaderFields when the client is created.

However, for token refreshes (via NXOAuthClient -refreshAccessToken), even when the customHeaderFields property has meaningful custom values set in it, those values are not applied to the refresh request.

#0  0x0000000107fef5f9 in -[NXOAuth2Connection applyParameters:onRequest:] 
#1  0x0000000107fef064 in -[NXOAuth2Connection createConnection] 
#2  0x0000000107fee59e in -[NXOAuth2Connection initWithRequest:requestParameters:oauthClient:delegate:] 
#3  0x0000000107ff85cc in -[NXOAuth2Client refreshAccessTokenAndRetryConnection:] 

(lldb) po self
<NXOAuth2Client: 0x7f92a1972180>

(lldb) po [self customHeaderFields]
{
    "Content-Type" = "application/x-www-form-urlencoded";
}

Even in the above scenario ^, the token refresh request continues to default to multi-part, which triggers the warning. Stream has been reopened after close

It doesn't appear that multi-part form POST requests are working correctly. If they are, the warning needs to be removed, or at the very least a comment should be added clarifying that the warning indicates a condition which is innocuous. If the warning is there for a reason, multi-part form POST requests need to be fixed, or at the very least there needs to be some kind of a hook to allow clients to work around this for token refresh requests by specifying "Content-Type" = "application/x-www-form-urlencoded"; and/or honoring customHeaderFields, which is ignored for a token refresh.