oauthlib / oauthlib/oauthlib

Modifications of headers returned by Client.prepare_*_request affects future calls

Open
#873 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
3k
Forks
529
PR merge metrics
No merged PRs in 30d

Description

Describe the bug

If I modify the headers dictionary returned by a Client.prepare_*_request method, the future calls to any of these methods return the modified headers.

How to reproduce

>>> import oauthlib.oauth2
>>> client = oauthlib.oauth2.WebApplicationClient('my client id')
>>> _, headers, _ = client.prepare_authorization_request('https://example.com')
>>> headers
{'Content-Type': 'application/x-www-form-urlencoded'}
>>> headers['Content-Length'] = '0'
>>> _, headers, _ = client.prepare_authorization_request('https://example.com')
>>> headers
{'Content-Type': 'application/x-www-form-urlencoded', 'Content-Length': '0'}
>>> _, headers, _ = client.prepare_token_request('https://example.com')
>>> headers
{'Content-Type': 'application/x-www-form-urlencoded', 'Content-Length': '0'}
>>> _, headers, _ = client.prepare_refresh_token_request('https://example.com')
>>> headers
{'Content-Type': 'application/x-www-form-urlencoded', 'Content-Length': '0'}

Expected behavior

Either:

>>> import oauthlib.oauth2
>>> client = oauthlib.oauth2.WebApplicationClient('my client id')
>>> _, headers, _ = client.prepare_authorization_request('https://example.com')
>>> headers['Content-Length'] = '0'
>>> _, headers, _ = client.prepare_authorization_request('https://example.com')
>>> headers
{'Content-Type': 'application/x-www-form-urlencoded'}
>>> _, headers, _ = client.prepare_token_request('https://example.com')
>>> headers
{'Content-Type': 'application/x-www-form-urlencoded'}
>>> _, headers, _ = client.prepare_refresh_token_request('https://example.com')
>>> headers
{'Content-Type': 'application/x-www-form-urlencoded'}

or

>>> import oauthlib.oauth2
>>> client = oauthlib.oauth2.WebApplicationClient('my client id')
>>> _, headers, _ = client.prepare_authorization_request('https://example.com')
>>> try:
...     headers['Content-Length'] = '0'
... except Exception:
...     print('an exception occurred')
... 
an exception occurred

or

this unusual feature being documented

Additional context

Please provide any further context here.

  • Are you using OAuth1, OAuth2 or OIDC? OAuth2
  • Are you writing client or server side code? client
  • If client, what provider are you connecting to? a custom one
  • Are you using a downstream library, such as requests-oauthlib, django-oauth-toolkit, ...? no

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the Client.prepare_authorization_request, prepare_token_request, and prepare_refresh_token_request entry points shown in the reproduction. Reproduce the shared-header behavior, then trace how each method creates or reuses its returned headers. Done means modifying one returned headers dictionary does not affect later calls, with regression coverage for the demonstrated OAuth2 client behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.