Add client_id and client_secret on revoke_token
#71
Conversation
| @@ -151,7 +151,6 @@ function OAuthProvider() { | |||
|
|
|||
| getRefreshToken() { | |||
| var data = { | |||
| client_id: config.clientId, | |||
There was a problem hiding this comment.
Why did you removed the client_id here?
There was a problem hiding this comment.
id_client is not required when request has authorization header. See more at http://tools.ietf.org/html/rfc6749#section-6
But, I will rollback this change, because it is not about "Revoke Token"
|
@tinogomes Can you please apply the minor fixes as commented? Also, please squash the commits. Thanks. |
tinogomes
force-pushed
the
pullrequest
branch
2 times, most recently
from
a84ebe3 to
a6063e0
Compare
|
@ruipenso DONE! |
| token: OAuthToken.getRefreshToken() ? OAuthToken.getRefreshToken() : OAuthToken.getAccessToken() | ||
| }); | ||
|
|
||
| if(null !== config.clientSecret) { |
There was a problem hiding this comment.
Missing space after if, i.e., if (.
tinogomes
force-pushed
the
pullrequest
branch
from
a6063e0 to
a4d139c
Compare
|
@ruipenso REDONE! |
| @@ -363,6 +363,7 @@ describe('OAuthProvider', function() { | |||
| queryString.stringify.callCount.should.equal(1); | |||
| queryString.stringify.firstCall.args.should.have.lengthOf(1); | |||
| queryString.stringify.firstCall.args[0].should.eql({ | |||
| client_id: default.clientId, | |||
There was a problem hiding this comment.
defaults not default. The tests are not passing.
tinogomes
force-pushed
the
pullrequest
branch
from
a4d139c to
3e7dbd2
Compare
|
@ruipenso done! All tests passed. |
| }; | ||
|
|
||
| // To remove null values | ||
| for (var index in data) { |
There was a problem hiding this comment.
Ahm. You changed the latest code I reviewed.
Sorry, but can you keep the logic used in the other methods, i.e.,
var data = {
client_id: config.clientId,
token: OAuthToken.getRefreshToken() ? OAuthToken.getRefreshToken() : OAuthToken.getAccessToken()
};
if (null !== config.clientSecret) {
data.client_secret = config.clientSecret;
}
data = queryString.stringify(data);
3e7dbd2 to
523060e
Compare
|
@ruipenso I rollback last code, but on tests, the sort for expected keys can not be ascending |
|
@tinogomes I'm aware of it - no problem. Thanks for the PR. |
Add `client_id` and `client_secret` on revoke_token
Adapted from Django OAuth Tookit - Part 4 - Revoking an OAuth2 Token
Depending on the client type you’re using, the token revocation request you may submit to the authentication server may vary. A Public client, for example, will not have access to your Client Secret. A revoke request from a public client would omit that secret, but requires
client_id. If your application type is Confidential , it requires theclient_secret, so you will have to add it as one of the parameters.