applicake/doorkeeper — Issue #6: Access token response headers
Author: felipeelias
Created: 2011-12-01 10:13:37+00:00
State: open
Labels: bug

From [OAuth2 v22 spec](http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-5.1)

The authorization server MUST include the HTTP "Cache-Control" response header field [RFC2616] with a value of "no-store" in any response containing tokens, credentials, or other sensitive information, as well as the "Pragma" response header field [RFC2616] with a value of "no-cache".

For example:

HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
Cache-Control: no-store
Pragma: no-cache

{
"access_token":"2YotnFZFEjr1zCsicMWpAA",
"token_type":"example",
"expires_in":3600,
"refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
"example_parameter":"example_value"
}