jaredhanson
Wrong client secret silently fails to authenticate
I had a problem where my client secret had a trailing newline. When the client secret doesn't match, authentication validation on the client side of course fails, but there is no indication of what happened. I couldn't find any way to get any kind of debugging or error output without hacking up the source. There should be a clear indicator that the client secret is the problem, other than packet-tracing and decrypting traffic between client and oauth2 server.
Possibly a separate issue: if you specify the wrong CA to validate the TLS connection to the oauth2 server, this also fails silently. Surely connection errors ought to result in something getting logged or shown somewhere. It seems that anything like this gets swallowed.