Goodreads Developers discussion

According to the OAuth1 Implementation standards, section 6.1.2 (http://oauth.net/core/1.0a/#auth_step1), the request token and secret should be accompanied by `oauth_callback_confirmed` set to true. This is currently missing from your response. I'd like to see this implemented.

Hi Ethan, thanks for your bug report. We appreciate your looking into this. Is this causing you any other problems with the API?

No problems at all, actually - just the documented standards, so minor note at best.

Jeffrey wrote: "Hi Ethan, thanks for your bug report. We appreciate your looking into this. Is this causing you any other problems with the API?"
Hi Jeffrey, in flutter Oauth1 plugin oauth_callback_confirmed is expected and throw exception if missing. Please implement it.

See:
https://pub.dartlang.org/documentatio...

+1 here.

Golang package dghubble/oauth1 requires this property to be set to true.

See:
https://github.com/dghubble/oauth1

For those wondering, the "oauth_callback_confirmed" is required for OAuth 1.0a, not OAuth 1.0. Goodreads, as far as I can tell, uses 1.0.

This does make it potentially susceptable to session fixation https://oauth.net/advisories/2009-1/