indieauth
indieauth copied to clipboard
Require Accept headers in requests.
More strictly define the requests we expect clients to send to the endpoints, outside of just the (generally treated as non-normative) examples. This adds:
- The requirement for an HTTP
Accept
header ofapplication/json
when redeeming the authorization code. This hopefully avoids new clients having problems with old authorization endpoints that could have answered with anapplication/x-www-form-urlencoded
response. - The requirement for an HTTP
Accept
header ofapplication/json
when verifying a Bearer Token at the token endpoint.
As it ads language about the Accept
header, it also clarifies the use of URL spec's application/x-www-form-urlencoded format and its matching Content-Type
header to the redeem step.
Fixes #18. (I think.)