jaredhanson / jaredhanson/oauth2orize

token middleware - missing grant_type results in unsupported_grant_type error

Open
#89 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3.5k
Forks
472
PR merge metrics
No merged PRs in 30d

Description

If the `grant_type` parameter is missing in the request, the token middleware will return with a `501` header with the following body:

```
{
error: 'unsupported_grant_type',
error_description: 'Unsupported grant type: test'
}
```

If I'm not mistaking, [the specs](http://tools.ietf.org/html/rfc6749#section-5.2) state that this should be a `400 - invalid_request` response.

I suggest a patch where the middleware returns a `400` header with the following body:

```
{
error: 'invalid_request',
error_description: 'Missing required field: grant_type'
}
```

Contributor guide

Open the contributing guide

Research direction

Start at the token middleware's handling of a missing grant_type and compare its response with RFC 6749 section 5.2. Verify the status and error body for a request without grant_type; done means it returns 400 with invalid_request and the specified missing-field description.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
authentication, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.