access_token field added to request url when oauth2_access_token already present

When trying to make a request for a LinkedIn resource I was recieving an unpermitted field error.

b’{“serviceErrorCode”:100,“message”:“Unpermitted fields present in PARAMETER: Data Processing Exception while processing fields [/access_token]”,“status”:403}

Manual review of the URL revealed 2 access token related fields:

1. oauth2_access_token
2. access_token

Looking at the OAuth2-Requests source code in requests-oauthlib/requests_oauthlib/oauth2_session.py, the access_token field is added to the url right before making the final request via the add_token() method.

I imagine there is a mechanism in place to prevent the behavior but I could not find it? My solution was to copy a modified version of the oauth2_session.py module into my project with this dirty fix inside the request() method.

old_version_url = url
url, headers, data = self._client.add_token(url, 
        http_method=method, body=data, headers=headers)
if "&access_token=" in url:
    url = old_version_url

Is there an official way to modify this behavior? Is this a bug? Please advise.

Thanks

[tuseau]

It would be nice to have this fixed as it has completely broken the Linkedin integration.

[jtroussard]

This has been solved with PR #397