Client secret never validated in AuthServer? about oauth2-server

[alexbilbie]

The client_secret isn't verified at that stage. In the authorisation grant it is verified when the client exchanges an authorisation code for an access token.

https://github.com/lncd/OAuth2/blob/master/src/OAuth2/AuthServer.php#L377 - loads whichever grants have enabled, for example the authorisation code grant and it is verified in each grant's completeFlow() method https://github.com/lncd/OAuth2/blob/master/src/OAuth2/Grant/AuthCode.php#L62

[fkarlsson]

Then where is the problem in my implementation? I use the ruby gem oauth2 to test my setup and no matter which secret I input it works. Do I need to change the grant_type that I send?

Edit: Did not see your edit! Alright, so the problem with my implementation is my getClient function which never checks for the secret. I made this mistake as it was never included in the oauth2-example-auth-server.

Thanks for the help and most of all for a great library!