{"action":"created","issue":{"url":"https://api.github.com/repos/Filsh/yii2-oauth2-server/issues/116","repository_url":"https://api.github.com/repos/Filsh/yii2-oauth2-server","labels_url":"https://api.github.com/repos/Filsh/yii2-oauth2-server/issues/116/labels{/name}","comments_url":"https://api.github.com/repos/Filsh/yii2-oauth2-server/issues/116/comments","events_url":"https://api.github.com/repos/Filsh/yii2-oauth2-server/issues/116/events","html_url":"https://github.com/Filsh/yii2-oauth2-server/issues/116","id":194999736,"number":116,"title":"Resource Owner grant type requiring client_id and client_secret","user":{"login":"jonmunm","id":942926,"avatar_url":"https://avatars.githubusercontent.com/u/942926?v=3","gravatar_id":"","url":"https://api.github.com/users/jonmunm","html_url":"https://github.com/jonmunm","followers_url":"https://api.github.com/users/jonmunm/followers","following_url":"https://api.github.com/users/jonmunm/following{/other_user}","gists_url":"https://api.github.com/users/jonmunm/gists{/gist_id}","starred_url":"https://api.github.com/users/jonmunm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonmunm/subscriptions","organizations_url":"https://api.github.com/users/jonmunm/orgs","repos_url":"https://api.github.com/users/jonmunm/repos","events_url":"https://api.github.com/users/jonmunm/events{/privacy}","received_events_url":"https://api.github.com/users/jonmunm/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-12-12T15:16:45Z","updated_at":"2016-12-13T07:34:00Z","closed_at":null,"body":"Why the password grant_type must be provided with client credentials (in this implementation)???. The oauth2 resource owner spec just needs \r\n\r\n```\r\n{\r\n    \"grant_type\" : \"password\",\r\n    \"username\" : \"some_user_name\",\r\n    \"password\" : \"some_password\"\r\n}\r\n```\r\n\r\nThis implementation also requires the **client_id** and **client_secret** to be sent with this request to be successfull.\r\n\r\nI just want to know if I'm missing something\r\n\r\nPlease refer also to http://andyfiedler.com/2014/09/how-secure-is-the-oauth2-resource-owner-password-credential-flow-for-single-page-apps\r\n\r\nI want to grant access from my SPA to the protected resource. Exposing client credentials in the browser source code is potentially dangerous.\r\n\r\nAlso, the original library at https://bshaffer.github.io/oauth2-server-php-docs/overview/grant-types/ doesn't force client credential in resource owner grant type"},"comment":{"url":"https://api.github.com/repos/Filsh/yii2-oauth2-server/issues/comments/266667304","html_url":"https://github.com/Filsh/yii2-oauth2-server/issues/116#issuecomment-266667304","issue_url":"https://api.github.com/repos/Filsh/yii2-oauth2-server/issues/116","id":266667304,"user":{"login":"mtangoo","id":1502872,"avatar_url":"https://avatars.githubusercontent.com/u/1502872?v=3","gravatar_id":"","url":"https://api.github.com/users/mtangoo","html_url":"https://github.com/mtangoo","followers_url":"https://api.github.com/users/mtangoo/followers","following_url":"https://api.github.com/users/mtangoo/following{/other_user}","gists_url":"https://api.github.com/users/mtangoo/gists{/gist_id}","starred_url":"https://api.github.com/users/mtangoo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mtangoo/subscriptions","organizations_url":"https://api.github.com/users/mtangoo/orgs","repos_url":"https://api.github.com/users/mtangoo/repos","events_url":"https://api.github.com/users/mtangoo/events{/privacy}","received_events_url":"https://api.github.com/users/mtangoo/received_events","type":"User","site_admin":false},"created_at":"2016-12-13T07:34:00Z","updated_at":"2016-12-13T07:34:00Z","body":"Am not sure either what was the purpose of that. I will let @Filsh answer that. That being said you have another option. Create dummy client and secret and then pass them with request.\r\n\r\nOtherwise I have created a fork of this library that I maintain. You can send PR or File a bug\r\n\r\nhttps://github.com/hosannahighertech/yii2-oauth2-server"}}
{"actor":{"display_login":"mtangoo"}}