diff options
| author | Jonathan Huot <jonathan.huot@thomsonreuters.com> | 2018-12-04 16:08:13 +0100 |
|---|---|---|
| committer | Jonathan Huot <jonathan.huot@thomsonreuters.com> | 2018-12-04 16:08:13 +0100 |
| commit | ffa87c7ec828e5c0a7c68a2197030f20b15ec621 (patch) | |
| tree | b3e8333ee50b9348adce4d2782e0e6889808f96c /oauthlib/oauth2/rfc6749/grant_types/authorization_code.py | |
| parent | 51c927b0641adcef6e5944c9a67ba1d7edc2eb68 (diff) | |
| download | oauthlib-ffa87c7ec828e5c0a7c68a2197030f20b15ec621.tar.gz | |
Handle 401 with WWW-Authenticate. Moved wrong 401 into 400.
access_denied/unauthorized_client/consent_required/login_required MUST be 400, and not 401. Also, 401 MUST have WWW-Authenticate when set. It could have an impact of processing those in webframeworks.
Diffstat (limited to 'oauthlib/oauth2/rfc6749/grant_types/authorization_code.py')
| -rw-r--r-- | oauthlib/oauth2/rfc6749/grant_types/authorization_code.py | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py b/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py index 8ebae49..334ed56 100644 --- a/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py +++ b/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py @@ -243,6 +243,8 @@ class AuthorizationCodeGrant(GrantTypeBase): log.debug('Token request validation ok for %r.', request) except errors.OAuth2Error as e: log.debug('Client error during validation of %r. %r.', request, e) + if e.status_code == 401: + headers.update({"WWW-Authenticate": "Basic"}) return headers, e.json, e.status_code token = token_handler.create_token(request, refresh_token=self.refresh_token, save_token=False) |