Potential problem in Generic OAuth implementation.

The generic OAuth implementation has the code:

        req = HTTPRequest(url,
                          method=self.userdata_method,
                          headers=headers,
                          validate_cert=self.tls_verify,
                          body=urllib.parse.urlencode({'access_token': access_token})
                          )
        resp = yield http_client.fetch(req)
        resp_json = json.loads(resp.body.decode('utf8', 'replace'))

The userdata_method is set as:

    userdata_method = Unicode(
        os.environ.get('OAUTH2_USERDATA_METHOD', 'GET'),
        config=True,
        help="Userdata method to get user data login information"
    )

The problem is that Tornado implements sanity checks and will error if you try and use GET method where you supply a body for the request. The result is an exception of:

ValueError: Body must be None for method GET (unless allow_nonstandard_methods is true)

The workaround was to set in the configuration userdata_method to POST as the target URL for getting user info must allow both GET and POST.

• http://openid.net/specs/openid-connect-core-1_0.html#UserInfo

So this should perhaps default to using POST for userdata_method since is accepted anyway. Alternatively, need to pass allow_nonstandard_methods=True to HTTPRequest class when initialised.

[manics]

Is this still an issue?

[consideRatio]

@manics I submitted a #376 about the deprecation of the userdata_method, and think we should close this issue no matter what at this point as @minrk fixed the key issue of sending data in a request.