twitter/joauth — pull request #11 by ryangreenberg (2013-06-19 23:18:43+00:00)
Title: Unpack params in request body from non-POST HTTP requests

JOAuth currently only unpacks (and subsequently signs) parameters in the request body if the request is an HTTP POST with Content-Type `application/x-www-form-urlencoded`. This is too constrained, based on my reading of the IETF [OAuth spec,](http://tools.ietf.org/html/rfc5849) [section 3.4.1.3.1](http://tools.ietf.org/html/rfc5849#section-3.4.1.3.1). (yes, I know that looks like a joke citation).

My reading of 3.4.1.3.1 is that parameters in the request body should be unpacked and signed if:

- The body is single-part.
- The body is valid "application/x-www-form-urlencoded".
- The Content-Type header "application/x-www-form-urlencoded" is present.

Since requests with verbs other than POST can meet these requirements, I propose removing the HTTP method check in Unpacker.scala.

I added a test case for an HTTP PUT request that fails without change that I made in 800ced1. I had to make some tweaks to the test cases because the idea of GET and POST as the only HTTP methods is a little baked into the suite. It would probably make tests easier to understand if the parameter `paramsInPost` was renamed everywhere to `paramsInBody` or `paramsInRequestBody`.

---

Here you can see that the new tests fail without my final commit:

```
$ joauth git:(remove_post_body_restriction) git revert 800ced1ea5e7fda94bd37bcbb3e6cafb18cbc7e8
[remove_post_body_restriction 1e26f1c] Revert "Unpack params in form-urlencoded request body regardless of HTTP method"
1 file changed, 9 insertions(+), 6 deletions(-)
$ joauth git:(remove_post_body_restriction) mvn clean test

Tests run: 297, Failures: 10, Errors: 2, Skipped: 0

[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 44.496s
[INFO] Finished at: Wed Jun 19 16:14:44 PDT 2013
[INFO] Final Memory: 18M/207M
[INFO] ------------------------------------------------------------------------
```