search

requests / requests-oauthlib

OAuthlib support for Python-Requests!
https://requests-oauthlib.readthedocs.org/
ISC License
1.71k stars 422 forks source link

Should passing 'state' to authorization_url() also update self._state #414

Closed mattbaker-digital closed 4 years ago

mattbaker-digital commented 4 years ago

If state is not passed to OAuth2Session.authorization_url() a new state value is generated and assigned to self._state. If state is passed to authorization_url() then self._state is not updated.

Is this behaviour correct? Should self._state also be updated to match the authorization_url() passed state value?

jtroussard commented 4 years ago

I cannot speak for the original developer but I think the idea here is that if the program passes the state, it inherently manages that value and doesn't need to set the OAuth2Session class variable. Additionally the method returns the same state, perhaps for verification. I'll admit on the surface this does appears odd, thanks for pointing this peculiarity out.

Ultimately if this isn't causing a bug, the design can stay.