Repository: oauthlib/oauthlib

Issue:
Client id always included in body of token request
I use the WebApplication client and in [`prepare_request_body`](https://github.com/idan/oauthlib/blob/master/oauthlib/oauth2/rfc6749/clients/web_application.py#L88-L89) I noticed the `client_id` parameter is never used. However [`self.client_id`](https://github.com/idan/oauthlib/blob/master/oauthlib/oauth2/rfc6749/clients/web_application.py#L127-L128) is always passed down to `prepare_token_request` and thus always included in the body.

An unused parameter doesn't look good but maybe this is intended, I've only quickly read the RFC 6749. If this is the case it should at least be stated in the docstring.

The server here (I guess OpenAM) rejects queries when they contain the client_id in the body.

Comments:

Patch:
diff --git a/README.rst b/README.rst
index eb85ffa..656d72c 100644
--- a/README.rst
+++ b/README.rst
@@ -56,6 +56,7 @@ The following packages provide OAuth support using OAuthLib.
 - For Django there is `django-oauth-toolkit`_, which includes `Django REST framework`_ support.
 - For Flask there is `flask-oauthlib`_ and `Flask-Dance`_.
 - For Pyramid there is `pyramid-oauthlib`_.
+- For Bottle there is `bottle-oauthlib`_.
 
 If you have written an OAuthLib package that supports your favorite framework,
 please open a Pull Request, updating the documentation.
@@ -65,6 +66,7 @@ please open a Pull Request, updating the documentation.
 .. _`Django REST framework`: http://django-rest-framework.org
 .. _`Flask-Dance`: https://github.com/singingwolfboy/flask-dance
 .. _`pyramid-oauthlib`: https://github.com/tilgovi/pyramid-oauthlib
+.. _`bottle-oauthlib`: https://github.com/thomsonreuters/bottle-oauthlib
 
 Using OAuthLib? Please get in touch!
 ------------------------------------
diff --git a/docs/faq.rst b/docs/faq.rst
index 4d896f5..0c61af9 100644
--- a/docs/faq.rst
+++ b/docs/faq.rst
@@ -65,10 +65,17 @@ How do I use OAuthLib with Google, Twitter and other providers?
 How do I use OAuthlib as a provider with Django, Flask and other web frameworks?
 --------------------------------------------------------------------------------
 
-    Providers using Django should seek out `django-oauth-toolkit`_
-    and those using Flask `flask-oauthlib`_. For other frameworks,
-    please get in touch by opening a `GitHub issue`_, on `G+`_ or
-    on IRC #oauthlib irc.freenode.net.
+    Providers can be implemented in any web frameworks. However, some of
+    them have ready-to-use libraries to help integration:
+    - Django `django-oauth-toolkit`_
+    - Flask `flask-oauthlib`_
+    - Pyramid `pyramid-oauthlib`_
+    - Bottle `bottle-oauthlib`_
+
+    For other frameworks, please get in touch by opening a `GitHub issue`_, on `G+`_ or
+    on IRC #oauthlib irc.freenode.net. If you have written an OAuthLib package that
+    supports your favorite framework, please open a Pull Request to update the docs.
+
 
 What is the difference between authentication and authorization?
 ----------------------------------------------------------------
@@ -91,6 +98,8 @@ Some argue OAuth 2 is worse than 1, is that true?
 .. _`requests-oauthlib`: https://github.com/requests/requests-oauthlib
 .. _`django-oauth-toolkit`: https://github.com/evonove/django-oauth-toolkit
 .. _`flask-oauthlib`: https://github.com/lepture/flask-oauthlib
+.. _`pyramid-oauthlib`: https://github.com/tilgovi/pyramid-oauthlib
+.. _`bottle-oauthlib`: https://github.com/thomsonreuters/bottle-oauthlib
 .. _`GitHub issue`: https://github.com/idan/oauthlib/issues/new
 .. _`G+`: https://plus.google.com/communities/101889017375384052571
 .. _`difference`: http://www.cyberciti.biz/faq/authentication-vs-authorization/
diff --git a/docs/oauth2/endpoints/endpoints.rst b/docs/oauth2/endpoints/endpoints.rst
index 0e70798..9bd1c4e 100644
--- a/docs/oauth2/endpoints/endpoints.rst
+++ b/docs/oauth2/endpoints/endpoints.rst
@@ -23,7 +23,7 @@ handles user authorization, the token endpoint which provides tokens and the
 resource endpoint which provides access to protected resources. It is to the
 endpoints you will feed requests and get back an almost complete response. This
 process is simplified for you using a decorator such as the django one described
-later.
+later (but it's applicable to all other web frameworks librairies).
 
 The main purpose of the endpoint in OAuthLib is to figure out which grant type
 or token to dispatch the request to.
diff --git a/docs/oauth2/server.rst b/docs/oauth2/server.rst
index 9d6b502..9900e36 100644
--- a/docs/oauth2/server.rst
+++ b/docs/oauth2/server.rst
@@ -6,8 +6,10 @@ OAuthLib is a dependency free library that may be used with any web
 framework. That said, there are framework specific helper libraries
 to make your life easier.
 
-- For Django there is `django-oauth-toolkit`_.
-- For Flask there is `flask-oauthlib`_.
+- Django `django-oauth-toolkit`_
+- Flask `flask-oauthlib`_
+- Pyramid `pyramid-oauthlib`_
+- Bottle `bottle-oauthlib`_
 
 If there is no support for your favourite framework and you are interested
 in providing it then you have come to the right place. OAuthLib can handle
@@ -17,6 +19,8 @@ as well as provide an interface for a backend to store tokens, clients, etc.
 
 .. _`django-oauth-toolkit`: https://github.com/evonove/django-oauth-toolkit
 .. _`flask-oauthlib`: https://github.com/lepture/flask-oauthlib
+.. _`pyramid-oauthlib`: https://github.com/tilgovi/pyramid-oauthlib
+.. _`bottle-oauthlib`: https://github.com/thomsonreuters/bottle-oauthlib
 
 .. contents:: Tutorial Contents
     :depth: 3
diff --git a/oauthlib/oauth2/rfc6749/clients/web_application.py b/oauthlib/oauth2/rfc6749/clients/web_application.py
index c099d99..bc62c8f 100644
--- a/oauthlib/oauth2/rfc6749/clients/web_application.py
+++ b/oauthlib/oauth2/rfc6749/clients/web_application.py
@@ -125,7 +125,7 @@ class WebApplicationClient(Client):
         """
         code = code or self.code
         return prepare_token_request('authorization_code', code=code, body=body,
-                                     client_id=self.client_id, redirect_uri=redirect_uri, **kwargs)
+                                     client_id=client_id, redirect_uri=redirect_uri, **kwargs)
 
     def parse_request_uri_response(self, uri, state=None):
         """Parse the URI query for code and state.


Test patch:
diff --git a/tests/oauth2/rfc6749/clients/test_web_application.py b/tests/oauth2/rfc6749/clients/test_web_application.py
index 85b247d..0a80c9a 100644
--- a/tests/oauth2/rfc6749/clients/test_web_application.py
+++ b/tests/oauth2/rfc6749/clients/test_web_application.py
@@ -38,7 +38,7 @@ class WebApplicationClientTest(TestCase):
     code = "zzzzaaaa"
     body = "not=empty"
 
-    body_code = "not=empty&grant_type=authorization_code&code=%s&client_id=%s" % (code, client_id)
+    body_code = "not=empty&grant_type=authorization_code&code=%s" % code
     body_redirect = body_code + "&redirect_uri=http%3A%2F%2Fmy.page.com%2Fcallback"
     body_kwargs = body_code + "&some=providers&require=extra+arguments"