xamarin / Xamarin.Auth

Xamarin.Auth

Apache License 2.0

541 stars 351 forks source link

Dont include client secret in URL #397

Open dendle opened 5 years ago

dendle commented 5 years ago

Authenticate using HTTP BASIC auth instead

Xamarin.Auth Pull Request

Fixes #261 (At least for people using identity server 4)

Checklist

[ ] I have included examples or tests - Cannot find a test project covering this
[ ] I have updated the change log - cannot find a changelog file
[ ] I am listed in the CONTRIBUTORS file - cannot find CONTRIBUTORS file
[ ] I have cleaned up the commit history (use rebase and squash)

Changes proposed in this pull request:

In code flow, when exchanging the code for a token at the token endoint, correctly authenticate to the IdP using HTTP BASIC auth, and do not send the client_secret as plaintext in the URL. (Follows RFC)

dendle commented 5 years ago

Here's the relevant RFC section that this fix implements: https://tools.ietf.org/html/rfc6749#section-4.1.3