google / google/GoogleSignIn-iOS
Revoke request uses GET instead of POST
- Dominant language
- Objective-C
- Stars
- 750
- Forks
- 282
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 9
Description
-disconnectWithCompletion: sends the revocation request over GET, because startFetchURL: builds an NSMutableURLRequest without setting HTTPMethod.
Our documentation ([mobile](https://developers.google.com/identity/protocols/oauth2/native-app#tokenrevoke)) says to use a POST request; and [RFC 7009 section 2.1](https://datatracker.ietf.org/doc/html/rfc7009#section-2.1) specifies a POST carrying the token in a form-encoded body.
Contributor guide
Research direction
Start at -disconnectWithCompletion: and follow its call to startFetchURL:, where the NSMutableURLRequest is created. Compare the revocation request with the linked Google documentation and RFC 7009 section 2.1; done means the request uses POST and carries the token in a form-encoded body.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- objective-c
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100