socialcast/devise_oauth2_providable — Issue #25: [Security problem] Auth code strategy doesn't verify client secret!
Author: BRMatt
Created: 2011-11-27 18:59:58+00:00
State: open

According to the [latest OAuth 2.0 spec](http://tools.ietf.org/html/draft-ietf-oauth-v2-22) the `client_secret` parameter [is required](http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-2.3.1) when authenticating the client for access tokens.

Currently the secret is [created in the model](https://github.com/socialcast/devise_oauth2_providable/blob/master/app/models/devise/oauth2_providable/client.rb#L20), but the `authorization_code` strategy [only checks for the `client_id`](https://github.com/socialcast/devise_oauth2_providable/blob/master/lib/devise/oauth2_providable/strategies/oauth2_grant_type_strategy.rb#L16) and ignores the `client_secret`.