Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added documentation for save_access_token, temporary credentials must not be reused. #202

Closed
wants to merge 1 commit into from

Conversation

squirly
Copy link
Contributor

@squirly squirly commented Aug 2, 2013

The server MUST ... ensure that the temporary
credentials have not expired or been used before.

RFC 5849 section-2.3

@ib-lundgren
Copy link
Collaborator

Excellent. I think we should take it one step further and add a specific method for this similar to invalidate_authorization_code that is invoked before returning the access token.

@kdazzle
Copy link
Contributor

kdazzle commented Aug 3, 2013

@ib-lundgren I agree - it becomes more explicit and wouldn't make save_access_token do more than its name suggests.

@squirly squirly deleted the doc-fix branch September 14, 2013 03:52
swistakm added a commit to swistakm/oauthlib that referenced this pull request May 22, 2014
- add link to Section 2.3 RFC 5849 that explains why there is a need for
  token invalidation and give a clue how it can be invalidated (refs oauthlib#202)
- add example implementation of validate_realms
- explain why `verify_request_token` does not double functionality of
  `validate_request_token` (refs oauthlib#185)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants