oauth.getToken() wrongly requires access_token
markstos opened this issue · 4 comments
The oauth/token endpoint does not require that an access token be sent to Strava.
However, this library implements it using oauth.getToken() and the shared util.postEndpoint() function, which does require an access token because another consumer of postEndpoint does require an access_token.
For privacy and security, calls to oauth.getToken() should not require an access_token.
I may address this today as part of another refactor I'm working on.
I'm still having this issue, is there a workaround?
@mattgreenfield Yes. You can use my ra-fixes branch, which addresses this and a number of other items: https://github.com/rideamigoscorp/node-strava-v3/tree/ra-fixes Or you could look more narrowly at the patches linked here and patch your own copy.
Finally, you could use Strava's officially supported approach which is to use generated code to generate a JavaScript client library based off their Swagger definition: https://developers.strava.com/docs/#client-code.
The project maintainers of this repo haven't updated it in a couple of years, so I would expect new activity here soon.
This fix will appear in the next release.