eclipse-ee4j / eclipse-ee4j/jersey
OAuth1 client does not include non-POST 'application/x-www-form-urlencoded' form entity-body parameters in OAuth1 signature base string
Open
Component: security
oauth
oauth1
oauth1-client
Priority: Major
pull-request
Type: Bug
- Dominant language
- Java
- Stars
- 730
- Forks
- 382
- PR merge metrics
- No merged PRs in 30d
Description
Pull request with a fix and detailed comments @: [https://github.com/jersey/jersey/pull/160](https://github.com/jersey/jersey/pull/160)
Gist of the Jersey oauth1-client implementation is usage of very old oauth-core convention which effectively request entity body signatures and their validation for non-POST requests with 'application/x-www-form-urlencoded' request entity bodies (only query parameters included in the signature thing).
#### Affected Versions
[2.17]
Contributor guide
Assessment
This issue has not been assessed yet.