Skip to content

Improve Content-Type Validation for Token Endpoint Requests#929

Open
Kris-Val wants to merge 1 commit intooauthlib:masterfrom
Kris-Val:validate-bad-content-type
Open

Improve Content-Type Validation for Token Endpoint Requests#929
Kris-Val wants to merge 1 commit intooauthlib:masterfrom
Kris-Val:validate-bad-content-type

Conversation

@Kris-Val
Copy link
Copy Markdown

This change introduces explicit validation of the Content-Type header for token endpoint requests. When the request’s Content-Type does not match the expected value, it now raises a clear and descriptive error.

Issue #928 – oauthlib/oauthlib

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR introduces explicit Content-Type validation for OAuth2 token endpoint requests, addressing issue #928. When a request's Content-Type header doesn't match the expected application/x-www-form-urlencoded, the server now returns a clear error message.

Key changes:

  • Added UnsupportedContentTypeError exception class for Content-Type validation errors
  • Implemented _raise_on_bad_content_type() validation method in the base endpoint
  • Integrated Content-Type validation into token endpoint request processing
  • Added comprehensive test coverage for the new validation across multiple grant types

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 10 comments.

File Description
oauthlib/oauth2/rfc6749/errors.py Defines new UnsupportedContentTypeError exception for Content-Type validation failures
oauthlib/oauth2/rfc6749/endpoints/base.py Implements _raise_on_bad_content_type() validation method to check Content-Type headers
oauthlib/oauth2/rfc6749/endpoints/token.py Integrates Content-Type validation into token request validation flow
tests/oauth2/rfc6749/endpoints/test_error_responses.py Adds test cases verifying Content-Type validation across web, legacy, and backend application servers

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread oauthlib/oauth2/rfc6749/endpoints/base.py Outdated
Comment thread tests/oauth2/rfc6749/endpoints/test_error_responses.py Outdated
Comment thread tests/oauth2/rfc6749/endpoints/test_error_responses.py Outdated
Comment thread oauthlib/oauth2/rfc6749/endpoints/base.py Outdated
Comment thread tests/oauth2/rfc6749/endpoints/test_error_responses.py
Comment thread oauthlib/oauth2/rfc6749/endpoints/base.py Outdated
Comment thread tests/oauth2/rfc6749/endpoints/test_error_responses.py Outdated
Comment thread tests/oauth2/rfc6749/endpoints/test_error_responses.py Outdated
Comment thread tests/oauth2/rfc6749/endpoints/test_error_responses.py
Comment thread tests/oauth2/rfc6749/endpoints/test_error_responses.py
@auvipy auvipy self-requested a review November 29, 2025 16:02
Comment thread oauthlib/oauth2/rfc6749/endpoints/base.py Outdated
@Kris-Val Kris-Val force-pushed the validate-bad-content-type branch from 02e8cbc to 922b9fc Compare December 1, 2025 12:16
This change introduces explicit validation of the Content-Type header for token endpoint requests. When the request’s Content-Type does not match the expected value, it now raises a clear and descriptive error.
@Kris-Val Kris-Val force-pushed the validate-bad-content-type branch from 922b9fc to 68caf4f Compare December 1, 2025 12:23
Copy link
Copy Markdown
Member

@auvipy auvipy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not sure why the CI is not running

@auvipy auvipy closed this Mar 9, 2026
@auvipy auvipy reopened this Mar 9, 2026
Copy link
Copy Markdown
Member

@auvipy auvipy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you please fix the lint errors?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants