From 1576af3fa59abab57ffaa3c330787e5813eb35e1 Mon Sep 17 00:00:00 2001 From: nbloomf Date: Wed, 8 Jul 2020 00:05:14 -0500 Subject: [PATCH] Replace call to `fetchAccessToken` with `fetchAccessToken2` This comment comes from hoauth2: -- OAuth2 spec allows `client_id` and `client_secret` to -- either be sent in the header (as basic authentication) -- OR as form/url params. -- The OAuth server can choose to implement only one, or both. -- Unfortunately, there is no way for the OAuth client (i.e. this library) to -- know which method to use. Please take a look at the documentation of the -- service that you are integrating with and either use `fetchAccessToken` or `fetchAccessToken2` `fetchAccessToken2` is a drop-in replacement for `fetchAccessToken` that just adds `client_id` and `client_secret` to the body as form parameters, as permitted by [RFC 6749](https://tools.ietf.org/html/rfc6749#section-2.3.1). Some authorization server implementations only accept client credentials in this form. --- src/Yesod/Auth/OAuth2/Dispatch.hs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Yesod/Auth/OAuth2/Dispatch.hs b/src/Yesod/Auth/OAuth2/Dispatch.hs index f96581a..9011758 100644 --- a/src/Yesod/Auth/OAuth2/Dispatch.hs +++ b/src/Yesod/Auth/OAuth2/Dispatch.hs @@ -67,7 +67,7 @@ dispatchCallback name oauth2 getCreds = do code <- requireGetParam "code" manager <- authHttpManager oauth2' <- withCallbackAndState name oauth2 csrf - token <- errLeft $ fetchAccessToken manager oauth2' $ ExchangeToken code + token <- errLeft $ fetchAccessToken2 manager oauth2' $ ExchangeToken code creds <- errLeft $ tryFetchCreds $ getCreds manager token setCredsRedirect creds where