tree 361e8f2666760579192243e78f89b7a4064c7ace
parent d89af98d7c6bba047c5a2622f36bc14b8766df85
author Aeneas Rekkas (arekkas) <aeneas@ory.am> 1498144328 +0200
committer JBD <jbd@google.com> 1505251745 +0000

internal: urlencode client id and secret in header

As per https://tools.ietf.org/html/rfc6749#section-2.3.1 client IDs and secrets must be urlencoded in the authorization header. This patch addresses this by wrapping clientID and clientSecret with url.QueryEscape. A dedicated test for unsafe-url client IDs and secrets has been added as well.

Closes #237

Change-Id: I1f277b52caef4932e14147be8fb1712203da51d0
Reviewed-on: https://go-review.googlesource.com/46473
Reviewed-by: JBD <jbd@google.com>