oauth2-server icon indicating copy to clipboard operation
oauth2-server copied to clipboard

AuthCodeGrant doesn't reply with invalid_grant on bad "code" request paramter, but with invalid_request

Open paulmhh opened this issue 7 months ago • 6 comments

https://www.rfc-editor.org/rfc/rfc6749#section-5.2 says: invalid_grant The provided authorization grant (e.g., authorization code[...]) is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client.

but https://github.com/thephpleague/oauth2-server/blob/2ed9e5f65045bebf9e99c33ef1558dcd6d0206b7/src/Grant/AuthCodeGrant.php#L126

throws a "invalid_request" instead. That is not RFC conform

paulmhh avatar Jul 31 '24 15:07 paulmhh