[jira] [Updated] (SHINDIG-1786) Utilizing an OAuth2 refresh token to obtain an access token should handle a 400 response

["Adam Clarke (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/SHINDIG-1786?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Adam Clarke updated SHINDIG-1786:
---------------------------------

    Attachment: refresh_token.patch
    
> Utilizing an OAuth2 refresh token to obtain an access token should handle a 400 response
> ----------------------------------------------------------------------------------------
>
>                 Key: SHINDIG-1786
>                 URL: https://issues.apache.org/jira/browse/SHINDIG-1786
>             Project: Shindig
>          Issue Type: Bug
>          Components: Java
>    Affects Versions: 2.5.0-beta1
>            Reporter: Stanton Sievers
>            Assignee: Stanton Sievers
>              Labels: OAuth2
>             Fix For: 2.5.0
>
>         Attachments: refresh_token.patch
>
>
> In the newest version of the OAuth2 spec, the language around the behavior for failure when using a refresh token has been made more explicit.  
> See: http://tools.ietf.org/html/draft-ietf-oauth-v2-26#section-6  
> Also see: http://tools.ietf.org/html/draft-ietf-oauth-v2-26#section-5.2
> Currently in BasicOAuth2Request we only check for a 401 response to indicate that the refresh token is "bad" and should be discarded.  The updated spec language indicates that a 400 is also a valid response to indicate a bad refresh token.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira