{"action":"closed","issue":{"url":"https://api.github.com/repos/p2/OAuth2/issues/264","repository_url":"https://api.github.com/repos/p2/OAuth2","labels_url":"https://api.github.com/repos/p2/OAuth2/issues/264/labels{/name}","comments_url":"https://api.github.com/repos/p2/OAuth2/issues/264/comments","events_url":"https://api.github.com/repos/p2/OAuth2/issues/264/events","html_url":"https://github.com/p2/OAuth2/issues/264","id":327238651,"node_id":"MDU6SXNzdWUzMjcyMzg2NTE=","number":264,"title":"OAuth2PasswordGrant doesn't use client_id and client_secret","user":{"login":"FSMaxB-divae","id":39257564,"node_id":"MDQ6VXNlcjM5MjU3NTY0","avatar_url":"https://avatars0.githubusercontent.com/u/39257564?v=4","gravatar_id":"","url":"https://api.github.com/users/FSMaxB-divae","html_url":"https://github.com/FSMaxB-divae","followers_url":"https://api.github.com/users/FSMaxB-divae/followers","following_url":"https://api.github.com/users/FSMaxB-divae/following{/other_user}","gists_url":"https://api.github.com/users/FSMaxB-divae/gists{/gist_id}","starred_url":"https://api.github.com/users/FSMaxB-divae/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FSMaxB-divae/subscriptions","organizations_url":"https://api.github.com/users/FSMaxB-divae/orgs","repos_url":"https://api.github.com/users/FSMaxB-divae/repos","events_url":"https://api.github.com/users/FSMaxB-divae/events{/privacy}","received_events_url":"https://api.github.com/users/FSMaxB-divae/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-05-29T09:27:06Z","updated_at":"2018-06-01T09:08:12Z","closed_at":"2018-06-01T09:08:12Z","author_association":"NONE","body":"When making a request using the Resource Owner Password Credentials grant type, it should send the client id and secret via the HTTP basic auth authorization header, but instead they are just ignored.\r\n\r\nThis can be worked around by manually setting the request header, but this really should be done automatically by the library!\r\n\r\nRelevant section of [RFC6749](https://tools.ietf.org/html/rfc6749#section-4.3):\r\n\r\n>  (B) The client requests an access token from the authorization server's token endpoint by including the credentials received from the resource owner.  **When making the request, the client authenticates with the authorization server.**\r\n>  (C)  **The authorization server authenticates the client** and validates the resource owner credentials, and if valid, issues an access token."}}
{"actor":{"display_login":"FSMaxB-divae"}}