OAuth1 standards not met

[Ethan]

According to the OAuth1 Implementation standards, section 6.1.2 (http://oauth.net/core/1.0a/#auth_step1), the request token and secret should be accompanied by `oauth_callback_confirmed` set to true. This is currently missing from your response. I'd like to see this implemented.

[Jeff]

Hi Ethan, thanks for your bug report. We appreciate your looking into this. Is this causing you any other problems with the API?

[Ethan]

No problems at all, actually - just the documented standards, so minor note at best.

[Денис]

Jeffrey wrote: "Hi Ethan, thanks for your bug report. We appreciate your looking into this. Is this causing you any other problems with the API?"
Hi Jeffrey, in flutter Oauth1 plugin oauth_callback_confirmed is expected and throw exception if missing. Please implement it.

See:
https://pub.dartlang.org/documentatio...

[Connor]

+1 here.

Golang package dghubble/oauth1 requires this property to be set to true.

See:
https://github.com/dghubble/oauth1

[Alex]

For those wondering, the "oauth_callback_confirmed" is required for OAuth 1.0a, not OAuth 1.0. Goodreads, as far as I can tell, uses 1.0.

This does make it potentially susceptable to session fixation https://oauth.net/advisories/2009-1/