Add client_id and client_secret to OAuth2 config

It seems increasingly difficult to reopen makeRequest in ember-cli. I realize that client_secret is mostly redundant in a browser application, but some OAuth2 servers expect it regardless of whether the client is public or confidential.

Would it be possible to just add these specific items to the payload (or set the appropriate header) if they are present in the user’s config?

[rotatingJazz]

So, I 've resolved the issue why the authenticator is not sending the form data to the api.

makerequest 's signature is (url, data), NOT (data) as mentioned in this thread.

Source: node_modules/ember-cli-simple-auth-oauth2/vendor-addon/ember-simple-auth/simple-auth-oauth2.amd.js, line 244.

[dustinfarris]

I understand that using client_secret with a public client seems redundant. It does remain, however, part of RFC6749 § 2.3 which states:

The authorization server MAY establish a client authentication method with public clients.

Since it is part of the specification, I see no reason not to support it (even if you choose not to promote it). Why not add the headers if the appropriate configuration variables are set? e.g. in oauth2#init:

this.clientId = globalConfig.clientId || "";
this.clientSecret = globalConfig.clientSecret || "";

and in oauth2#makeRequest:

if (this.clientId !== "" && this.clientSecret !== "") {
  headers = { "Authorization": "Basic " + btoa(this.clientId + ":" + this.clientSecret) };
} else {
  headers = {};
}
return Ember.$.ajax({
  url: this.serverTokenEndpoint,
  headers: headers,
  ...

I don’t see a reason to put the burden of overriding the method on the user when the behavior is explicitly outlined in the Proposed Standard.