domenic/restify-oauth2 — pull request #21 by ebymatthew (2014-04-15 15:55:43+00:00)
Title: Add an allowPublicClients option to disable check for Authentication header

This pull request replaces #20.

After further reading reading of the spec, my understanding is client type is a property of a client and not the entire server. With #20, the entire server would be configured public or confidential. With this PR a server could be configured to handle both public and confidential client types and act appropriately.

The *allowPublicClients* defaults to false to preserve compatibility with previous versions.

If the option is false:
* any request without an authentication header will be rejected.

If the option is true:
* requests without headers will be allowed, and clientId/clientSecret will be null
* requests with headers will be populated with the clientId and clientSecret

This approach also allows the potential for future support of the authorization_code grant type. Where you may receive a clientId but no secret: http://tools.ietf.org/html/rfc6749#section-3.2.1