oauthinaction / oauth-in-action-code

Source code for OAuth 2 in Action

Home Page:https://www.manning.com/books/oauth-2-in-action

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Express middleware over-writing headers

philjamaica opened this issue · comments

The Express middleware sets headers automatically, so code like this gets overwritten:
var headers = {
'Content-Type': 'application/x-www-form-urlencoded',
'Authorization': 'Basic ' + encodeClientCredentials(client.client_id, client.client_secret)
};

var tokRes = request('POST', authServer.tokenEndpoint, {	
		body: form_data,
		headers: headers
});

If you check what's actually in the headers of tokRes you'll see something like:
Headers: { 'x-powered-by': 'Express',
'content-type': 'application/json; charset=utf-8',
'content-length': '33',
etag: 'W/"21-occYTPXPStEvVz6I6gFNf+WJ+pg"',
date: 'Thu, 21 Jun 2018 23:43:03 GMT',
connection: 'close' }

This basically makes it impossible to pass client_id, client_secret in headers.

Ignore - I misunderstood what was going on.