All issues

Search results

Implicit grant success redirect uses wp_safe_redirect(), likely broken for foreign-host clients

Status: Open.

#16 In humanmade/OAuth2;

· roborourke opened on Sep 1, 2026

Add support for Dynamic Client Registration (RFC 7591)

Status: Open.

#13 In humanmade/OAuth2;

· roborourke opened on Sep 1, 2026

Support OAuth2 .well-known discovery endpoints

Status: Open.

#12 In humanmade/OAuth2;

· roborourke opened on Sep 1, 2026

Replace the OAuth 1.0a documentation

Status: Open.

#10 In humanmade/OAuth2;

· roborourke opened on Aug 31, 2026

Reconsider the implicit grant

Status: Open.

#9 In humanmade/OAuth2;

· roborourke opened on Aug 31, 2026

Garbage-collect expired authorization codes

Status: Open.

#8 In humanmade/OAuth2;

· roborourke opened on Aug 31, 2026

Match redirect URIs exactly, not just scheme/host/port/path

Status: Open.

#7 In humanmade/OAuth2;

· roborourke opened on Aug 31, 2026

Migrate remaining authorisation-endpoint errors to redirect responses

Status: Open.

#6 In humanmade/OAuth2;

· roborourke opened on Aug 31, 2026

Bind and verify redirect_uri at token exchange

Status: Open.

#5 In humanmade/OAuth2;

· roborourke opened on Aug 31, 2026

Return RFC 6749 §5.2 error bodies from the token endpoint

Status: Open.

#4 In humanmade/OAuth2;

· roborourke opened on Aug 31, 2026

Authenticate confidential clients on the authorization_code grant

Status: Open.

#3 In humanmade/OAuth2;

· roborourke opened on Aug 31, 2026

Add integration tests on WordPress Playground

Status: Open.

#2 In humanmade/OAuth2;

· roborourke opened on Aug 31, 2026