[PR] Review of OAuth implementation for compliance to standards [ponymail-foal]

["arkanovicz (via GitHub)" <gi...@apache.org>]

arkanovicz opened a new pull request, #338:
URL: https://github.com/apache/ponymail-foal/pull/338

   Review the OAuth client implementation:
   
   Legacy (unchanged): the frontend folds `state` into the `redirect_uri` and the server forwards the callback parameters verbatim to the token URL, with no client secret involved — the ASF OAuth flow used by lists.apache.org.
   
   New (opt-in): a provider with `.client_secret` gets a standard RFC 6749 exchange (`grant_type`, `code`, `redirect_uri`, `client_id`, `client_secret`), and with `standard: true` the frontend sends a constant` redirect_uri` and `state` as its own parameter, as strict providers require.
   
   Co-authored with Fable 5.1, fully reviewed.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@ponymail.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org