ciaranj/connect-auth — pull request #100 by evanp (2012-05-23 16:19:21+00:00)
Title: Add validateNotReplayClient() method for OAuthDataProvider

The validateNotReplay() method of the OAuthDataProvider interface takes an accessToken, a timestamp, and a nonce. Per http://tools.ietf.org/html/rfc5849#section-3.3 , "The nonce value MUST be unique across all requests with the same timestamp, client credentials, and token combinations."

However, for 2-legged oauth, an accessToken isn't provided, so the uniqueness can't be verified.

This patch adds another method, validateNotReplayClient() to the OAuthDataProvider interface. It's identical to validateNotReplay(), but it takes another parameter: the consumerKey. This is passed for 2- and 3-legged OAuth.

If the new method is not found, the old one will be used instead.