Send client_secret when get oauth2 refresh_token

With some oauth2 providers, the oauth client_secret is required when getting a refresh_token.
2015-11-23 10:10:00 +01:00
parent db37cf6a58
commit 98a81c9fbd
1 changed files with 4 additions and 2 deletions
@@ -154,10 +154,12 @@ server for requests.  It can be used for the optional"scope" parameters for Face
        code = current.request.vars.code

        if code or refresh_token:
-            data = dict(client_id=self.client_id)
+            data = dict(
+                client_id=self.client_id,
+                client_secret=self.client_secret,
+            )
            if code:
                data.update(
-                    client_secret=self.client_secret,
                    redirect_uri=current.session.redirect_uri,
                    code=code,
                    grant_type='authorization_code'