code review 125940043: goauth2: error out on empty access token

goauth2: forbid empty access token, include json response in error

Fixes issue 32.
Fixes issue 33.

[adg, 2014-08-11 06:05:21]

Hello bradfitz (cc: golang-codereviews@googlegroups.com),

I'd like you to review this change to
https://code.google.com/p/goauth2

[bradfitz, 2014-08-11 15:27:14]

LGTM
On Aug 10, 2014 11:05 PM, <adg@golang.org> wrote:

> Reviewers: bradfitz,
>
> Message:
> Hello bradfitz (cc: golang-codereviews@googlegroups.com),
>
> I'd like you to review this change to
> https://code.google.com/p/goauth2
>
>
> Description:
> goauth2: error out on empty access token
>
> Fixes issue 32.
>
> Please review this at https://codereview.appspot.com/125940043/
>
> Affected files (+4, -0 lines):
>   M oauth/oauth.go
>
>
> Index: oauth/oauth.go
> ===================================================================
> --- a/oauth/oauth.go
> +++ b/oauth/oauth.go
> @@ -39,6 +39,7 @@
>
>  import (
>         "encoding/json"
> +       "errors"
>         "io/ioutil"
>         "mime"
>         "net/http"
> @@ -378,6 +379,9 @@
>                 // so compensate here.
>                 b.ExpiresIn *= time.Second
>         }
> +       if b.Access == "" {
> +               return errors.New("received empty access token from
> authorization server")
> +       }
>         tok.AccessToken = b.Access
>         // Don't overwrite `RefreshToken` with an empty value
>         if len(b.Refresh) > 0 {
>
>
>

[bradfitz, 2014-08-11 19:29:14]

LGTM

https://codereview.appspot.com/125940043/diff/20001/oauth/oauth.go
File oauth/oauth.go (right):

https://codereview.appspot.com/125940043/diff/20001/oauth/oauth.go#newcode359
oauth/oauth.go:359: body, err := ioutil.ReadAll(r.Body)
I'd put an io.LimitReader on this, capping it to, say, 1<<20 which is still
ridiculous

[adg, 2014-08-11 23:24:25]

*** Submitted as https://code.google.com/p/goauth2/source/detail?r=7fc9d958c834
***

goauth2: forbid empty access token, include json response in error

Fixes issue 32.
Fixes issue 33.

LGTM=bradfitz
R=bradfitz
CC=golang-codereviews
https://codereview.appspot.com/125940043

https://codereview.appspot.com/125940043/diff/20001/oauth/oauth.go
File oauth/oauth.go (right):

https://codereview.appspot.com/125940043/diff/20001/oauth/oauth.go#newcode359
oauth/oauth.go:359: body, err := ioutil.ReadAll(r.Body)
On 2014/08/11 19:29:14, bradfitz wrote:
> I'd put an io.LimitReader on this, capping it to, say, 1<<20 which is still
> ridiculous

Done.