[question] Token Endpoint responses with 'success' even when client-secret is wrong

[amoraitis]

Hitting the Token-Endpoint with incorrect client-secret value returns HTTP Status 200 OK, with an error.

Is that expected? Should not this return another response code (failure) and return the error in the JSON response as defined here?

Example from Microsoft's implementation.

[casbin-bot]

@tangyang9464 @JalinWang @imp2002

[hsluoyz]

@amoraitis Casdoor returns HTTP 200 for application-level errors, to differ from network errors. Use status and msg to parse the error