What kind of change does this PR introduce? (check at least one)

• [ ] Bugfix
• [ ] Feature
• [ ] Code style update
• [ ] Refactor
• [x] Other, please describe:

We recently launched a new page specifically geared towards developers on auth0.com. Can we change the link in the sponsorship message?

Thanks again for your open-source work!

Does this PR introduce a breaking change? (check one)

• [ ] Yes
• [x] No

• [x] You consent that the copyright of your pull request source code belongs to Authlib's author.

When a refresh token expired, the authlib reply with 400 invalid_request error: Invalid "refresh_token" in request. However, the 400 invalid_grant should be returned , see https://tools.ietf.org/html/rfc6749#section-5.2 :

The provided authorization grant (e.g., authorization code, resource owner credentials) or refresh token is invalid, expired, revoked, ...

@pradyunsg thanks. I've invited you.

ping @bmcculley

今天做阿里钉钉的时候，， 钉钉的请求接口用的字段不是client_id而是appid字段， 这样的结果就是调用auth.dingding.authorize_redirect()生成的url中client_id在钉钉的接口中是无效的

我想寻求的帮助是。。如何把client_id变成appid

You can use authorize_params:

oauth.register(
  name='dingding',
  authorize_params={'appid': 'xxx'},
  ...
)

Please ask help in StackOverflow.

It is already done by https://github.com/lepture/authlib/pull/270. Thanks.

What kind of change does this PR introduce? (check at least one)

• [x] Bugfix
• [ ] Feature
• [ ] Code style update
• [ ] Refactor
• [ ] Other, please describe:

Does this PR introduce a breaking change? (check one)

• [x] Yes, for users of very old HTTPX version (0.11.x)
• [ ] No

In HTTPX 0.11.x auth argument to the AsyncClient.request had None as default. Since 0.12 default is changed to a sentinel object of type UnsetType. Users should upgrade their HTTPX version.

• [x] You consent that the copyright of your pull request source code belongs to Authlib's author.

We are using HTTPX 0.14 and faced the issue when authlib's AsyncOauth2Client had a token but never provided it to the underlying client because auth argument to AsyncOauth2Client.request method always had a value of httpx._config.UNSET and not None (code expects it to be None).

HTTPX version 0.14.3 Authlib version 0.14.3

Fixes #268 Fixes #269

What kind of change does this PR introduce? (check at least one)

• [x] Bugfix
• [x] Feature
• [ ] Code style update
• [ ] Refactor
• [ ] Other, please describe:

Does this PR introduce a breaking change? (check one)

• [ ] Yes

• [x] No

• [x] You consent that the copyright of your pull request source code belongs to Authlib's author.

Describe the bug The OAuth1 implementation for HTTPX does not set the content-length header, which can cause problems when using body signatures and talking to servers who block body POSTs where the length header is not specified.

Expected behavior

Content-Length header is set.

Environment:

• OS: linux
• Python Version: 3.8
• Authlib Version: 0.14.3

Incoming PR fixes this.

Is your feature request related to a problem? Please describe.

HTTPX has synchronous APIs as well as async, authlib should support both.

Additional context

Incoming PR supplies this.

Describe the bug

Authorization header is not automatically added to requests made using AsyncAssertionClient with HTTPX 0.14.2 or 0.14.3, but it does with HTTPX 0.14.1.

Error Stacks

Kinda cagey here because it's an internal endpoint.

    client = AsyncAssertionClient(...)
    await client.refresh_token()  # works as expected in either version.
    response = await client.post(
        "https://*****.com/v1/*****",
        #     headers={
        #         "Authorization": f'{client.token["token_type"]} {client.token["access_token"]}'
        #     },
        json={....},
)

With trace logging in 0.14.1

...
TRACE [2020-09-16 23:57:09] httpcore._async.connection - connection.request method=b'POST' url=(b'https', b'*****.com', None, b'/v1/*****') headers=[
    (b'host', b'*****.com'), 
    (b'user-agent', b'python-httpx/0.14.1'), 
    (b'accept', b'*/*'), 
    (b'accept-encoding', b'gzip, deflate'), 
    (b'connection', b'keep-alive'), 
    (b'content-length', b'82'), 
    (b'content-type', b'application/json'), 
    (b'authorization', b'Bearer [***access_token***]')]
TRACE [2020-09-16 23:57:09] httpcore._async.http11 - send_request method=b'POST' url=(b'https', b'*****.com', None, b'/v1/*****') headers=[(b'host', b'*****.com'), (b'user-agent', b'python-httpx/0.14.1'), (b'accept', b'*/*'), (b'accept-encoding', b'gzip, deflate'), (b'connection', b'keep-alive'), (b'content-length', b'82'), (b'content-type', b'application/json'), (b'authorization', b'Bearer [***access_token***]')]
TRACE [2020-09-16 23:57:09] httpcore._async.http11 - send_data=Data(<82 bytes>)
DEBUG [2020-09-16 23:57:10] httpx._client - HTTP Request: POST https://*****.com/v1/***** "HTTP/1.1 200 OK"
...

Swapping in 0.14.3

$ .venv/bin/python -m pip install httpx==0.14.3                                                                                                                                        
Collecting httpx==0.14.3                                                                                                                                                               
  Using cached httpx-0.14.3-py3-none-any.whl (62 kB)                                                                                                                                   
Requirement already satisfied: httpcore==0.10.* in ./.venv/lib/python3.8/site-packages (from httpx==0.14.3) (0.10.2)                                                                   
Requirement already satisfied: certifi in ./.venv/lib/python3.8/site-packages (from httpx==0.14.3) (2020.6.20)                                                                         
Requirement already satisfied: sniffio in ./.venv/lib/python3.8/site-packages (from httpx==0.14.3) (1.1.0)                                                                             
Requirement already satisfied: chardet==3.* in ./.venv/lib/python3.8/site-packages (from httpx==0.14.3) (3.0.4)                                                                        
Requirement already satisfied: rfc3986[idna2008]<2,>=1.3 in ./.venv/lib/python3.8/site-packages (from httpx==0.14.3) (1.4.0)                                                           
Requirement already satisfied: h11<0.10,>=0.8 in ./.venv/lib/python3.8/site-packages (from httpcore==0.10.*->httpx==0.14.3) (0.9.0)                                                    
Requirement already satisfied: idna; extra == "idna2008" in ./.venv/lib/python3.8/site-packages (from rfc3986[idna2008]<2,>=1.3->httpx==0.14.3) (2.10)                                 
Installing collected packages: httpx
  Attempting uninstall: httpx
    Found existing installation: httpx 0.14.1
    Uninstalling httpx-0.14.1:
      Successfully uninstalled httpx-0.14.1
Successfully installed httpx-0.14.3

In 0.14.3

TRACE [2020-09-16 23:55:16] httpcore._async.connection - connection.request method=b'POST' url=(b'https', b'*****.com', None, b'/v1/*****') headers=[
    (b'host', b'*****.com'), 
    (b'user-agent', b'python-httpx/0.14.3'), 
    (b'accept', b'*/*'), 
    (b'accept-encoding', b'gzip, deflate'), 
    (b'connection', b'keep-alive'), 
    (b'content-length', b'82'), 
    (b'content-type', b'application/json')]
TRACE [2020-09-16 23:55:16] httpcore._async.http11 - send_request method=b'POST' url=(b'https', b'*****.com', None, b'/v1/*****') headers=[(b'host', b'*****.com'), (b'user-agent', b'python-httpx/0.14.3'), (b'accept', b'*/*'), (b'accept-encoding', b'gzip, deflate'), (b'connection', b'keep-alive'), (b'content-length', b'82'), (b'content-type', b'application/json')]
TRACE [2020-09-16 23:55:16] httpcore._async.http11 - send_data=Data(<82 bytes>)
DEBUG [2020-09-16 23:55:16] httpx._client - HTTP Request: POST https://*****.com/v1/***** "HTTP/1.1 403 Forbidden"

...and the endpoint complains I didn't provide a valid Authorization key.

Expected behavior

Authorization header auto-added to request.

Environment:

• OS: Ubuntu 18.04
• Python Version: 3.8
• Authlib Version: 0.14.3

@nicktimko yes, HTTPX has breaking changes in 0.14.2. Please ping to httpx==0.14.1 until we released a new version.

https://github.com/lepture/authlib/commit/e30e653818fdaae7c6dea682ad1ea5530a5ebf7a

You can check the implementation of requests, there is no need to implemented it if you have set session=self.

if session=self, there is no need to re-write _refresh_token.

2 lines between class.

Is there a way to not using private module in httpx?

Actually, we had HTTPX sync API before, in version 0.13. But later after we released 0.13, HTTPX removed sync API for a while.

Fixes #266

DO NOT SEND ANY SECURITY FIX HERE. Please read "Security Reporting" section on README.

What kind of change does this PR introduce? (check at least one)

• [x] Bugfix
• [ ] Feature
• [ ] Code style update
• [ ] Refactor
• [ ] Other, please describe:

Does this PR introduce a breaking change? (check one)

• [ ] Yes
• [x] No

• [x] You consent that the copyright of your pull request source code belongs to Authlib's author.

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Incoming PR has unit test that reproduces the issue

Expected behavior

Token should "lock", preventing other coroutines from continuing until the token is refreshed

Environment:

• OS: Linux
• Python Version: 3.8
• Authlib Version: 0.14.3 and master

Thanks for your help.

In Django 3.1 the purely documentational feature of sending in providing_args when creating a Signal was deprecated: https://docs.djangoproject.com/en/3.1/releases/3.1/#id2

The purely documentational providing_args argument for Signal is deprecated. If you rely on this argument as documentation, you can move the text to a code comment or docstring.

This removes the argument so that we don't get deprecation warnings.

The feature has been purely documentational since 1.8 so this shouldn't break anybody's code.

What kind of change does this PR introduce? (check at least one)

• [x] Bugfix
• [ ] Feature
• [ ] Code style update
• [ ] Refactor
• [ ] Other, please describe:

Does this PR introduce a breaking change? (check one)

• [ ] Yes

• [x] No

• [x] You consent that the copyright of your pull request source code belongs to Authlib's author.

Thanks

@berzoidberg I'm not ready to support sync mode of httpx. currently httpx is not stable, it has many breaking changes. For example, I have locked httpx version to httpx==0.14.1, because 0.14.2 will break our code. I'd like to fix test cases for httpx==0.14.2 at first.

DO NOT SEND ANY SECURITY FIX HERE. Please read "Security Reporting" section on README.

What kind of change does this PR introduce? (check at least one)

• [x] Bugfix
• [ ] Feature
• [ ] Code style update
• [ ] Refactor
• [ ] Other, please describe:

Does this PR introduce a breaking change? (check one)

• [ ] Yes
• [x] No

The problem happens if server_metadata_url is used instead of manual passing access_token_url and token is not passed to request but via fetch_token callback registered in OAuth. When the token expires, and an OAuth resource is requested by invoking request/get/put, loader_server_metadata is skipped because token is not manually passed in (token=None). Thus, metadata is empty, OAuth2Auth.ensure_active_token() is unable to get token_endpoint, hence unable to refresh token, resulting in invalid token exception.

• [x] You consent that the copyright of your pull request source code belongs to Authlib's author.

@sidbelbase that is depending on your usage. You can use it without Markup at first.

I'm not sure if this is intended, but it seems odd to me that HTML entities are not escaped with escape = True:

>>> mistune.markdown('<', escape = True)
'<p>&lt;</p>\n'

I use mistune for comments, so I think of the goal of HTML escaping as not just security but "users should be able to type any non-markdown syntax and have it come out as typed", but this doesn't since the browser renders an unescaped < as an actual <.

I know Python 2.6 is old, but in the project that I working on we still use Python 2.6 I was able to port it to Python 2.6, it was not that difficult, most of the changes are related to init "set" datatypes. Would it be useful if I make a pull-request for it?

Actually, we are going to remove python 2 support in the next year.

For instance, **this** is an example. gets converted into <p>For instance, <strong>this</strong> is an example.</p>, can we customize this into only For instance, <strong>this</strong> is an example.

from mistune import markdown as mistune_markdown

@core.app_template_filter('markdown')
def markthatdown(any_text, **options):
    return Markup(mistune_markdown(any_text))

I'm using mistune in flask and it is already wrapped inside <p></p> so with the default also being enabled creates a nested <p> tags breaking UI.

Can we customize or disable <p></p> tags?

In v1, it is mistune.Renderer.

Thanks

A README example to quickly test the authorization code flow.

What kind of change does this PR introduce? (check at least one)

• [ ] Bugfix
• [x] Feature
• [ ] Code style update
• [ ] Refactor
• [ ] Other, please describe:

Does this PR introduce a breaking change? (check one)

• [ ] Yes
• [x] No

This allows to write server metadata file with insecure urls when developping locally, with the use of the AUTHLIB_INSECURE_TRANSPORT variable environment.

• [x] You consent that the copyright of your pull request source code belongs to Authlib's author.

@yujiri8 is correct.

using version 2.0.0a4, HTMLRenderer's heading cannot be customised when DirectiveToc is used for example, running the code below will result in two different behaviours.

import mistune
import mistune.directives import DirectiveToc

class Renderer(mistune.HTMLRenderer):
    def heading(self, text, level):
        return 'changed_heading'

test_a = mistune.create_markdown(
        renderer=Renderer(),
        plugins=[])
test_b = mistune.create_markdown(
        renderer=Renderer(),
        plugins=[DirectiveToc()])

print(test_a("# text")) #returns 'changed_heading'
print(test_b("# text")) #returns '<h1 id="toc_1">text</h1>'

This is because when DirectiveToc is used, the rendering process uses render_html_threading (from mistune.directives.toc.py) instead. This is not necessarily an issue, since it's impossible to handle arbitrary changes in the renderer while trying to put header ids in the html. Maybe this behaviour should be documented so that people can find which method to override when using DirectiveToc.

Is your feature request related to a problem? Please describe.

We would like to add a "Sign in with Apple" backend to loginpass but they currently deviate from the OAuth 2.0/OIDC specification in a few ways. One of them is that they indicate you can skip verifying the nonce using their own nonce_supported claim.

A Boolean value that indicates whether the transaction is on a nonce-supported platform. If you sent a nonce in the authorization request but do not see the nonce claim in the identity token, check this claim to determine how to proceed. If this claim returns true, you should tream nonce as mandatory and fail the transaction; otherwise, you can proceed treating the nonce as options.

https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api/authenticating_users_with_sign_in_with_apple

Describe the solution you'd like

Perhaps RemoteApp._parse_id_token could respect their nonce_supported claim?

Here's what we're doing in our project:

diff --git a/authlib/integrations/base_client/remote_app.py b/authlib/integrations/base_client/remote_app.py
index 170f2f9..0926859 100644
--- a/authlib/integrations/base_client/remote_app.py
+++ b/authlib/integrations/base_client/remote_app.py
@@ -197,5 +197,16 @@ class RemoteApp(BaseApp):
             claims_options=claims_options,
             claims_params=claims_params,
         )
+
+        # Apple can indicate that it wants us to skip verifying the nonce
+        if not claims.get('nonce_supported', True):
+            claims_params['nonce'] = None
+            claims = jwt.decode(
+                token['id_token'], key=load_key,
+                claims_cls=claims_cls,
+                claims_options=claims_options,
+                claims_params=claims_params,
+            )
+
         claims.validate(leeway=leeway)
         return UserInfo(claims)

Describe alternatives you've considered

I'm sure this isn't the first time you've encountered some backends deviating from the specification but I'm not sure how if this is something authlib or loginpass should condone.

We are going to release v0.15 soon, in about 2 weeks.

Try to customize with:

def theading(self, text, level, tid):
    return 'changed toc heading'

@briankzimmer I'm still not quite understand the problem. You can send a PR, I'll get what you want in the PR.

@leonidguadalupe you can manually expose it.

This is not an Authlib bug, as you can see, you have set it in session, but you didn't get it from session. Here is how you can test the problem yourself.

@app.route('/set-session')
def set_session_value():
    session['test-data'] = 'test'
    return 'ok'

@app.route('/get-session')
def get_session_value():
    return session.get('test-data', '')

Check if it has value in the session by:

1. visit /set-session
2. then visit /get-session

Another curl command in the README to access protected resources.

@bjmc it is not designed for RFC6749. RFC6749 is the foundation of OAuth 2.0, but the client that @briankzimmer is talking about is an OAuth 2.0 client that support many spec features.

@briankzimmer have you tried to subclass FlaskRemoteApp. For your description, the problem would be here: https://github.com/lepture/authlib/blob/master/authlib/integrations/base_client/base_app.py#L168

Thanks

DO NOT SEND ANY SECURITY FIX HERE. Please read "Security Reporting" section on README.

What kind of change does this PR introduce? (check at least one)

• [ ] Bugfix
• [ ] Feature
• [ ] Code style update
• [ ] Refactor
• [X] Other, please describe: Typo fix in spec

Does this PR introduce a breaking change? (check one)

• [ ] Yes
• [X] No

• [X] You consent that the copyright of your pull request source code belongs to Authlib's author.

@makeworld-the-better-one yes, it can be fixed. I don't have too much spare time in this library right now. But I'm happy to accept a PR.

The actual method to handle the token endpoint according to the doc and the example server seems to be something like this:

@blueprint.route('/token', methods=['POST'])
def access_token():
    return oauth.create_token_response()

This method handles form data as it calls the create_oauth_request with the argument use_json set to False. def create_oauth_request(request, request_cls, use_json=False)

A way to handle JSON data is to override the Authorization server and its method create_oauth2_request to call the one above with use_json=True

Like this:

class AuthServer(AuthorizationServer):
    def __init__(self, query_client=None, save_token=None):
        super().__init__(
            query_client=query_client,
            save_token=save_token,
        )

    def create_oauth2_request(self, request):
        return create_oauth_request(request, OAuth2Request, use_json=True)

But handling both and switching according to the incomming request's format is complicated. Can be done in such a way:

@blueprint.route('/token', methods=['POST'])
def access_token():
    has_form = bool(request.form)
    req = create_oauth_request(request, OAuth2Request, use_json=not has_form)
    return oauth.create_token_response(request=req)

But it feels silly to call a method that will be called again 2 levels after. It would be nice to have an elegant way to achieve this, if it does not already exists.

@YPCrumble Authlib respects standard. As RFC6749 stated, the payload should be in application/x-www-form-urlencoded, you can't send JSON payload to token endpoint. In this case, I will not accept such a PR.

You can always rewrite the create_oauth2_request method on your AuthorizationServer so that your provider can accept JSON payload. But Authlib won't provide it by default.

Also, it seems a duplicate issue to https://github.com/lepture/authlib/issues/156

It is really not a good idea to accept json payload in OAuth token endpoint. According to https://tools.ietf.org/html/rfc6749, you should send payload in application/x-www-form-urlencoded.

With your implementation, there will be one more non-compliance OAuth 2.0 provider. Authlib respects the standard, it will not provide such a method out of the box.

However, if you want, you can still create such a non-compliance provider by re-write the create_oauth2_request method.

@YPCrumble thanks. I've added error messages in https://github.com/lepture/authlib/commit/c4c23ae19963bf2be22404f3907dcce316994863

Please see attached a PR for #242 which adds specificity to error messages. The goal is to make it easier to debug any error messages as they happen to make configuration easier.

Please let me know if any questions or suggested improvements!

Bumps lodash from 4.17.15 to 4.17.19. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lodash/lodash/releases">lodash's releases</a>.</em></p> <blockquote> <h2>4.17.16</h2> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lodash/lodash/commit/d7fbc52ee0466a6d248f047b5d5c3e6d1e099056"><code>d7fbc52</code></a> Bump to v4.17.19</li> <li><a href="https://github.com/lodash/lodash/commit/2e1c0f22f425e9c013815b2cd7c2ebd51f49a8d6"><code>2e1c0f2</code></a> Add npm-package</li> <li><a href="https://github.com/lodash/lodash/commit/1b6c282299f4e0271f932b466c67f0f822aa308e"><code>1b6c282</code></a> Bump to v4.17.18</li> <li><a href="https://github.com/lodash/lodash/commit/a370ac81408de2da77a82b3c4b61a01a3b9c2fac"><code>a370ac8</code></a> Bump to v4.17.17</li> <li><a href="https://github.com/lodash/lodash/commit/1144918f3578a84fcc4986da9b806e63a6175cbb"><code>1144918</code></a> Rebuild lodash and docs</li> <li><a href="https://github.com/lodash/lodash/commit/3a3b0fd339c2109563f7e8167dc95265ed82ef3e"><code>3a3b0fd</code></a> Bump to v4.17.16</li> <li><a href="https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12"><code>c84fe82</code></a> fix(zipObjectDeep): prototype pollution (<a href="https://github-redirect.dependabot.com/lodash/lodash/issues/4759">#4759</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/e7b28ea6cb17b4ca021e7c9d66218c8c89782f32"><code>e7b28ea</code></a> Sanitize sourceURL so it cannot affect evaled code (<a href="https://github-redirect.dependabot.com/lodash/lodash/issues/4518">#4518</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/0cec225778d4ac26c2bac95031ecc92a94f08bbb"><code>0cec225</code></a> Fix lodash.isEqual for circular references (<a href="https://github-redirect.dependabot.com/lodash/lodash/issues/4320">#4320</a>) (<a href="https://github-redirect.dependabot.com/lodash/lodash/issues/4515">#4515</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/94c3a8133cb4fcdb50db72b4fd14dd884b195cd5"><code>94c3a81</code></a> Document matches* shorthands for over* methods (<a href="https://github-redirect.dependabot.com/lodash/lodash/issues/4510">#4510</a>) (<a href="https://github-redirect.dependabot.com/lodash/lodash/issues/4514">#4514</a>)</li> <li>Additional commits viewable in <a href="https://github.com/lodash/lodash/compare/4.17.15...4.17.19">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~mathias">mathias</a>, a new releaser for lodash since your current version.</p> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

In the Authorization server, the methodcreate_token_response called by the token endpoint processes a request object by has default request parameter set to None and nothing is passed to its call in the token endpoint in the routes file. How can it make a response token out of a none request body?

Because it is Flask. You can always: from flask import request.

no need for this line

Warehouse now uses the project_urls provided to display links in the sidebar on this screen, as well as including them in API responses to help automation tool find the source code for Requests. For example, see Django's setup.cfg and PyPI listing. PyPI already support rendering project descriptions from Markdown https://dustingram.com/articles/2018/03/16/markdown-descriptions-on-pypi/

we are not going to use README.md in pypi.

Case in point, I want to do this:

AUTHLIB_OAUTH_CLIENTS = {
    'google': {
        'client_id': '...',
        'client_secret': '...',
        'client_kwargs': {
            'scope': 'https://www.googleapis.com/auth/gmail.readonly',
            'include_granted_scopes': 'true',
        },
    },
}

scope is used, as expected, but include_granted_scopes is discarded, which is unexpected.

@vmsp I think what you want is authorize_params:

AUTHLIB_OAUTH_CLIENTS = {
    'google': {
        'client_id': '...',
        'client_secret': '...',
        'authorize_params': {
            'include_granted_scopes': 'true',
        },
        'client_kwargs': {
            'scope': 'https://www.googleapis.com/auth/gmail.readonly',
        },
    },
}

Can you leave the discovery endpoint URL? In our code: https://github.com/authlib/loginpass/blob/master/loginpass/azure.py#L34

issuer = issuer.replace('{tenantid}', tenant)

It is replacing {tenantid} instead of {tenant}, I think this is the problem.

The import on line 83 (https://github.com/authlib/loginpass/blob/66a5c6593f12bc4a537724d7212b1978d275b9fc/loginpass/_flask.py#L83) should read from authlib.integrations.flask_client import RemoteApp as FlaskRemoteApp instead of from authlib.integrations.flask_client import FlaskRemoteApp with authlib 0.14.

It is correct in the code.

i am trying to run this example, able to run and get login screen. Now i am entering the details in "Alexa" which is my client for this oauth server.

Able to get the login page from Alexa, However i am not able to navigate to Authorize after proper signing in.

Please help Regards, Punit

I can't understand your question.