krombel/oauth2
1
0
Fork 0
forked from remote/oauth2
Code Pull Requests 1 Activity

Clarify that client credentials are not passed in the URL

Browse Source 
The term "query parameters" suggested that the credentials are passed in the URL which is insecure and is actually not true as the credentials are passed in the request body. See 36a7019397/internal/token.go (L196)
This commit is contained in:
Peter Dotchev
2019-01-15 10:25:55 +02:00
committed by GitHub
parent 36a7019397
commit 3961bc9aff
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
oauth2.go
View File

@@ -31,7 +31,7 @@ var NoContext = context.TODO()
// which doesn't support the HTTP Basic authentication
// scheme to authenticate with the authorization server.
// Once a server is registered, credentials (client_id and client_secret)
// will be passed as query parameters rather than being present
// will be passed as parameters in the request body rather than being present
// in the Authorization header.
// See https://code.google.com/p/goauth2/issues/detail?id=31 for background.
func RegisterBrokenAuthHeaderProvider(tokenURL string) {