oauth2-server
oauth2-server copied to clipboard
AuthCodeGrant doesn't reply with invalid_grant on bad "code" request paramter, but with invalid_request
https://www.rfc-editor.org/rfc/rfc6749#section-5.2 says: invalid_grant The provided authorization grant (e.g., authorization code[...]) is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client.
but https://github.com/thephpleague/oauth2-server/blob/2ed9e5f65045bebf9e99c33ef1558dcd6d0206b7/src/Grant/AuthCodeGrant.php#L126
throws a "invalid_request" instead. That is not RFC conform