keyring
keyring copied to clipboard
OAuth2: add flag to hash token request parameters into `state`
We're seeing more services implement strict url matching with the redirect URI during an OAuth 2.0 authentication flow.
- This is already implemented for Instagram basic display API
- Mailchimp recently announced they would be enforcing this starting in Nov 2020.
Rather than doing this ad-hoc for each service, it would be more efficient to be able to opt in to this for any Oauth2 connection.
Idea from @pablinos
As using only the state parameter is the OAuth standard, I'm wondering if we should add the filter to
Keyring_Service_OAuth2if a flag is set ($this->pack_state = truein the constructor perhaps?), and then slowly convert the services.