ammmir/node-oauth2-provider — Issue #6: use of Authorization header for Basic Auth breaks OAuth provider
Author: RandomEtc
Created: 2012-01-26 01:20:50+00:00
State: open

OAuth2Provider looks for an access token in the http `authorization` header. The same header is also sent when using basic auth but because it doesn't contain a real token then OAuth2Provider responds with "400 Bad digest".

We have oauth2 access for some routes and basic auth for some others (for debugging). It would be great if the oauth provider didn't automatically respond but if it could be configured to allow fall through to other middleware.

Alternatively, the login method could be rearranged to fall-through to the subsequent route if the access token was found to be absent or invalid. Any preference either way?