jaredhanson / jaredhanson/oauth2orize
token middleware - missing grant_type results in unsupported_grant_type error
- Dominant language
- JavaScript
- Stars
- 3.5k
- Forks
- 472
- PR merge metrics
- No merged PRs in 30d
Description
If the `grant_type` parameter is missing in the request, the token middleware will return with a `501` header with the following body:
```
{
error: 'unsupported_grant_type',
error_description: 'Unsupported grant type: test'
}
```
If I'm not mistaking, [the specs](http://tools.ietf.org/html/rfc6749#section-5.2) state that this should be a `400 - invalid_request` response.
I suggest a patch where the middleware returns a `400` header with the following body:
```
{
error: 'invalid_request',
error_description: 'Missing required field: grant_type'
}
```
Contributor guide
Research direction
Start at the token middleware's handling of a missing grant_type and compare its response with RFC 6749 section 5.2. Verify the status and error body for a request without grant_type; done means it returns 400 with invalid_request and the specified missing-field description.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 52/100