App APIs using multiple accessToken passports

[corbanb]

I think I have an odd edge case here. We are working on an iOS app using the http-bearer authentication method + trying to link facebook-token passports together.

When we make a request we would like to pass the bearer auth token to prove a user is logged in and then attach and approve a facebook-token strategy.

I noticed this library sends a 400 if you have a header token + an access_token on the body of a post.

Is this a security issue of not allowing both since 2 potential tokens could be sent? Whats the work around if any?

[hspinks]

@corbanb were you ever able to figure out a solution / workaround? or are there any plans to change the behavior here?

[corbanb]

I just passed in different var names and trapped them before they got to the middleware to mange it on the way these expect them in steps @hspinks.