summaryrefslogtreecommitdiff
path: root/oauthlib/oauth2/rfc6749
diff options
context:
space:
mode:
authorJonathan Huot <jonathan.huot@thomsonreuters.com>2019-02-22 11:12:49 +0100
committerJonathan Huot <jonathan.huot@thomsonreuters.com>2019-02-22 11:12:49 +0100
commit54db1bfd65d1d17d1d45c12c8626b9e7fa84e694 (patch)
tree0b3a101ef58f8900e009eed2bb2137f3439edaa4 /oauthlib/oauth2/rfc6749
parent2904de612a5e52c14776978dd5a31cdde2bfc34e (diff)
downloadoauthlib-54db1bfd65d1d17d1d45c12c8626b9e7fa84e694.tar.gz
Remove usage of "state" for code/token response.
Diffstat (limited to 'oauthlib/oauth2/rfc6749')
-rw-r--r--oauthlib/oauth2/rfc6749/request_validator.py8
1 files changed, 1 insertions, 7 deletions
diff --git a/oauthlib/oauth2/rfc6749/request_validator.py b/oauthlib/oauth2/rfc6749/request_validator.py
index 193a9e1..5ff30d8 100644
--- a/oauthlib/oauth2/rfc6749/request_validator.py
+++ b/oauthlib/oauth2/rfc6749/request_validator.py
@@ -266,7 +266,6 @@ class RequestValidator(object):
- the redirect URI used (``request.redirect_uri``)
- a resource owner / user (``request.user``)
- the authorized scopes (``request.scopes``)
- - the client state, if given (``code.get('state')``)
To support PKCE, you MUST associate the code with:
- Code Challenge (``request.code_challenge``) and
@@ -277,10 +276,6 @@ class RequestValidator(object):
``{'code': 'sdf345jsdf0934f'}``
- It may also have a ``state`` key containing a nonce for the client, if it
- chose to send one. That value should be saved and used in
- ``.validate_code``.
-
It may also have a ``claims`` parameter which, when present, will be a dict
deserialized from JSON as described at
http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter
@@ -352,7 +347,7 @@ class RequestValidator(object):
'expires_in': 3600,
'scope': 'string of space separated authorized scopes',
'refresh_token': '23sdf876234', # if issued
- 'state': 'given_by_client', # if supplied by client
+ 'state': 'given_by_client', # if supplied by client (implicit ONLY)
}
Note that while "scope" is a string-separated list of authorized scopes,
@@ -559,7 +554,6 @@ class RequestValidator(object):
with the code in 'save_authorization_code':
- request.user
- - request.state (if given)
- request.scopes
- request.claims (if given)
OBS! The request.user attribute should be set to the resource owner