synapsestudios/synapse-base — pull request #123 by paulstatezny (2014-10-07 04:53:25+00:00)
Title: Implement OAuth2 Spec More Accurately

## Implement OAuth2 Spec More Accurately

[Section 3.1](https://tools.ietf.org/html/rfc6749#section-3.1) of the spec states that:

> Since requests to the authorization endpoint result in user authentication and the transmission of clear-text credentials (in the HTTP response), the authorization server MUST require the use of TLS as described in Section 1.6 when sending requests to the authorization endpoint.
>
> The authorization server MUST support the use of the HTTP "GET" method [RFC2616] for the authorization endpoint and MAY support the use of the "POST" method as well.
>
> Parameters sent without a value MUST be treated as if they were omitted from the request. The authorization server MUST ignore unrecognized request parameters. Request and response parameters MUST NOT be included more than once.

### Acceptance Criteria
1. Authorization endpoint only exists over HTTPS.
1. Authorization endpoint supports `GET` method as well as `POST` method.
1. Authorization endpoint ignores empty parameters.

### Tasks
- Modify route to enforce HTTPS
- Modify controller to get data from `GET` as well as `POST` methods.
- ~~Modify controller to unset any empty parameters.~~ (I think this is already implemented by the OAuth library.)

### Additional Notes
- Related to bshaffer/oauth2-server-php#466