Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

oauth session variables must be explicitly cleared before making authorize request #54

Open
lucasvickers opened this issue Jul 2, 2013 · 0 comments

Comments

@lucasvickers
Copy link

In a situation where a user has oauth tokens in their session variables, but makes a oauth.authorize request, the oauth request appears to get signed by the existing keys.

I noticed this explicitly for twitter where additional oauth authorize requests would fail unless I did

del session['twitter_oauth_tokens']

Upon writing this I acknowledge that it sounds weird to send in an oauth authorize request if the user already has this info in their session, but in my case the flask oauth may expire and the user is logging back in through twitter.

I am curious if there is a reason you don't automatically ignore oauth tokens on oauth.authorize requests?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant