Flask RemoteApp.authorize_access_token() includes state parameter in request about authlib

[lepture]

@lyschoening Did you try the Google connect on https://play.authlib.org/ ? Which works pretty well.

Besides, that state is recommended to be included in authorization request according to RFC:
https://tools.ietf.org/html/rfc6749#section-4.1.1

[lyschoening]

@lepture Is https://play.authlib.org/ a Flask app/sending the state parameter?

I'm authorizing through https://accounts.google.com/o/oauth2/token, not https://www.googleapis.com/oauth2/v4/token, which could explain why the behavior is different.

Google's documentation does not mention a state parameter
https://developers.google.com/identity/protocols/OAuth2WebServer#exchange-authorization-code and from reading around it seems this is known non-standard behavior in Google's API.

[lyschoening]

I should add that state isn't the only parameter being forwarded. Every parameter on the callback response is forwarded (authuser, session_state, prompt in this case).

[lepture]

@lyschoening Is there any reason that you have to use https://accounts.google.com/o/oauth2/token instead of https://www.googleapis.com/oauth2/v4/token

I'm ok to change the default behavior of request.args.to_dict(flat=True). But state will always be included, I don't think https://accounts.google.com/o/oauth2/token has done OAuth 2 right.

[lyschoening]

@lepture It's the URL in the configuration the Google Cloud console returns when you create an OAuth client for a web application.

[lepture]

@lyschoening I've cleaned up params in authorize_access_token.

Here is the endpoints that I found for Google: https://accounts.google.com/.well-known/openid-configuration