{"action":"opened","issue":{"url":"https://api.github.com/repos/postmanlabs/postman-app-support/issues/2565","repository_url":"https://api.github.com/repos/postmanlabs/postman-app-support","labels_url":"https://api.github.com/repos/postmanlabs/postman-app-support/issues/2565/labels{/name}","comments_url":"https://api.github.com/repos/postmanlabs/postman-app-support/issues/2565/comments","events_url":"https://api.github.com/repos/postmanlabs/postman-app-support/issues/2565/events","html_url":"https://github.com/postmanlabs/postman-app-support/issues/2565","id":195954950,"number":2565,"title":"Oauth 2 building invalid request for Authoriztion Code grant type","user":{"login":"jjlambros","id":19522448,"avatar_url":"https://avatars.githubusercontent.com/u/19522448?v=3","gravatar_id":"","url":"https://api.github.com/users/jjlambros","html_url":"https://github.com/jjlambros","followers_url":"https://api.github.com/users/jjlambros/followers","following_url":"https://api.github.com/users/jjlambros/following{/other_user}","gists_url":"https://api.github.com/users/jjlambros/gists{/gist_id}","starred_url":"https://api.github.com/users/jjlambros/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jjlambros/subscriptions","organizations_url":"https://api.github.com/users/jjlambros/orgs","repos_url":"https://api.github.com/users/jjlambros/repos","events_url":"https://api.github.com/users/jjlambros/events{/privacy}","received_events_url":"https://api.github.com/users/jjlambros/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-12-16T00:47:11Z","updated_at":"2016-12-16T00:47:11Z","closed_at":null,"body":"When using the Authorization tab, Type = OAuth 2.0 to get a new access token using the Authorization Code grant type - the request to exchange the code for a token (from the Postman callback URL to the Access Token URL) fails.  It includes the client is and secret in both an Authorization header and and body of the POST causing the code exchange to fail.\r\n\r\nThis is not allowed per RFC-6749 / 2.3 which states \"The client MUST NOT use more than one authentication method in each request.\".  The request is properly failed by our Ping Federate OAuth server with the message - {\"error_description\":\"The client MUST NOT use more than one authentication method in each request.\",\"error\":\"invalid_client\"}.\r\n\r\nPostman should omit the client_secret=xxx from the request body.  Leaving the client_id=xxx in the body is required for this grant type per RFC-6749 2.3.1 last paragraph.  Alternatively, Postman could omit the Basic Authorization header on the POST.\r\n\r\nPerhaps some OAuth servers don't enforce the RFC, however Ping Federate does.\r\n\r\nVersion/App Information:\r\n\r\n 1. Postman Version:  4.9.2\r\n 2. App (Chrome app or Mac app): Mac\r\n 3. OS details: OSX 10.11.6\r\n 4. Is the Interceptor on and enabled in the app: No\r\n 5. Did you encounter this recently, or has this bug always been there:  Don't know\r\n 6. Expected behaviour: client credentials either in header or body, but not both\r\n 7. Console logs None\r\n 8. Screenshots N/A\r\n\r\nSteps to reproduce the problem:\r\n\r\n1. Create any API call\r\n2. In Authorization tab, choose type OAuth 2.0\r\n3. Fill in all values and select Grant Type - Authorization Code\r\n4. Click request Token\r\n5. Complete and submit the OAuth credential page.\r\n6. Observe error in OAuth server logs or Gateway logs\r\n\r\n\r\n\r\n\r\n\r\n"}}
{"actor":{"display_login":"jjlambros"}}