Exceptions should be sent as an oauth error with server_error, not left to core's exception subscriber [#3334359]

Problem/Motivation

https://www.rfc-editor.org/rfc/rfc6749.html#section-4.1.2.1

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Comments

Comment #1

18 January 2023 at 02:54

bradjones1 created an issue.

Comment #2

bojan_dev CreditAttribution: bojan_dev commented 18 January 2023 at 13:50

This is already addressed in 6.0, here is another example were this pops up again: https://www.drupal.org/project/simple_oauth/issues/3225751#comment-14791779

I think this involves some refactoring, we should avoid architecture changes in 5.2.

Comment #3

bradjones1

English

CreditAttribution: bradjones1 at Not Vanilla, Inc. commented 18 January 2023 at 18:53

Thanks for the pointer. By architecture change, you mean a change to the shape of the error response?

Comment #4

bojan_dev CreditAttribution: bojan_dev commented 20 January 2023 at 12:34

Actually the OAuthServer from the league lib pretty much handles the shape of the error response and this varies based on the OAuth2 spec. What I meant with architecture changes; the oauth endpoints responses (including redirects) should be done by the League lib, this is currently not the case in simple_oauth:5.2 and involves refactoring.