The OAuth2 specification states that the application/x-www-form-urlencoded content-type should be used for the /tokens endpoint. Currently, authenticator breaks from the spec and only supports application/json content type, as this is the only supported content type in Tapis generally. However, this causes client oauth libs (e.g., Django's authlib) that adhere strictly to the spec to fail when trying to integrate with Tapis. Therefore, we should make an exception and allow application/x-www-form-urlencoded content for this one endpoint (only).
joestubbs
commented
2 years ago
The OAuth2 specification states that the application/x-www-form-urlencoded content-type should be used for the /tokens endpoint. Currently, authenticator breaks from the spec and only supports application/json content type, as this is the only supported content type in Tapis generally. However, this causes client oauth libs (e.g., Django's authlib) that adhere strictly to the spec to fail when trying to integrate with Tapis. Therefore, we should make an exception and allow application/x-www-form-urlencoded content for this one endpoint (only).