OAuth2: do not include client ID in body when using Basic Auth
JornWildt opened this issue · 0 comments
JornWildt commented
When doing OAuth2 "GetAccessTokenFromAuthorizationCode2":
POST ... HTTP/1.1
User-Agent: Ramone/1.0
Authorization: BASIC ...
Accept: application/json, application/json
Content-Type: application/x-www-form-urlencoded
Host: ...
Content-Length: 150
Expect: 100-continue
grant_type=authorization_code&code=1093a49c-eba9-4dd4-81ba-667f9d6c6756&redirect_uri=http%3a%2f%2flocalhost%2fSOME-PATH&client_id=...
In the above example "client_id" should NOT be in the body since it is included in the Authorization header.