songkick / oauth2-provider

Simple OAuth 2.0 provider toolkit
MIT License
526 stars 146 forks source link

POSTing JSON returning a bad 400 Bad Request on /oauth/authorize #58

Closed skunkworker closed 11 years ago

skunkworker commented 11 years ago

So I am running into a problem right now using a JSON Post to authorize that always seems to return a 400 Bad Request status.

I am setting the content type to application/json for the JSON Post.

{ "username": "user2@example.com", "password": "changeme",
"client_id": "[client_id]",
"client_secret":"[client_secret]",
"grant_type":"password",
"redirect_uri":"http://api.lvh.me:3000/oauth/callback"
}

but if I just do a regular POST with key value pairs, it works perfectly.

curl -X POST http://api.lvh.me:3000/oauth/authorize \
  -H "Content-Type: application/json" \
  -d 'client_id=[client_id]' \
  -d 'client_secret=[client=secret]' \
  -d 'redirect_uri=http://api.lvh.me:3000/oauth/callback' \
  -d 'grant_type=password' \
  -d 'username=user2@example.com' \
  -d 'password=changeme'

Is there something that I am missing when I try to use JSON instead? Here is my oauth/authorize command.

def authorize
    exchange = Songkick::OAuth2::Provider.parse(nil, request)
    logger.info exchange.inspect

    if exchange.redirect?
      redirect_to exchange.redirect_uri, status: exchange.response_status
    else
      response.headers.update(exchange.response_headers)
      render text: exchange.response_body, status: exchange.response_status 
    end
  end
jcoglan commented 11 years ago

JSON is not supported for authorizing, you should always use application/x-www-form-urlencoded request data.