idangazit/oauthlib — pull request #10 by ib-lundgren (2012-03-16 18:43:56+00:00)
Title: Section 3.(2|4|5) changes

I know the request is big and I can break it down into smaller pieces if that is desired. They are however almost all related to one paragraph of Section 3.2.

My updates include key checks and asserting that parameters are not passed in multiple times and places. In case of a bad request a ValueError is raised, on an unauthorized request False is returned.

The server SHOULD return a 400 (Bad Request) status code when
receiving a request with unsupported parameters, an unsupported
signature method, missing parameters, or duplicated protocol
parameters. The server SHOULD return a 401 (Unauthorized) status
code when receiving a request with invalid client credentials, an
invalid or expired token, an invalid signature, or an invalid or used
nonce.

As well as a snippet from 3.5

When making an OAuth-authenticated request, protocol parameters as
well as any other parameter using the "oauth_" prefix SHALL be
included in the request using one and only one of the following
locations, listed in order of decreasing preference:

I noticed that OAuthServer takes a signature method as an argument and then omit parsing it from requests, this is wrong. All clients should supply the signature method parameter on all requests, servers are free to allow clients to use any signature method they please and they may change between requests as well. A server may however want to restrict signature methods to only one, if that is the case then a list of allowed signature methods could be passed to the constructor (will send another pull request detailing this).