David Ramos

This would introduce a breaking change, unfortunately, due to `chrono::DateTime` being used in [`TokenIntrospectionResponse`](https://docs.rs/oauth2/4.2.2/oauth2/trait.TokenIntrospectionResponse.html), [`DeviceAccessTokenRequest::set_time_fn`](https://docs.rs/oauth2/4.2.2/oauth2/struct.DeviceAccessTokenRequest.html#method.set_time_fn), and potentially elsewhere. It will also increase the MSRV. I think it'll make sense to...

nice catch! I think we should try to make the `ureq` client match the `reqwest` client's behavior

I'd prefer not to add any implicit global state, but it should be possible for clients to pass in a closure that references an existing HTTP client without creating a...

this seems reasonable, and I'd welcome a PR! I'll be on a trip for the next couple of weeks, but I'll take a look when I get back

> Am I supposed to build my own client that injects the headers and checks the expiration time (or the 403 responses) to renew the access_token when needed? Yup. In...

hmm... I'm not quite sure what protocol Facebook is aiming to implement here, but it's not RFC 6749-compliant OAuth2, which [specifically states](https://datatracker.ietf.org/doc/html/rfc6749#section-3.2): > The client MUST use the HTTP "POST"...

Hey @mooreniemi, I'm not very well-versed in that RFC, but from a cursory glance it looks like the discovery process involves a separate request/response prior to starting the normal OAuth...

hmm it sounds like a bit of an odd (or at least quite uncommon) use case to have a redirect in response to this sort of POST request, so I...

what's the Display and/or Debug output of the parsing error?

please take a look at https://github.com/ramosbugs/openidconnect-rs/issues/34 (different crate, but same issue and suggestions). both crates expose a cause chain that can be walked to see the full diagnostic messages.