/token: Authorization header is not set

[bbigras]

I'm using this and the Authorization header doesn't seem to be set in the request:

clientSecret is set.

  const oauth2Token = await client.authorizationCode.getToken({
    code: code,
    redirectUri: "http://localhost:3000/callback"
  });

I'm wondering if this condition should be body.grant_type === 'authorization_code':

oauth2-client/src/client.ts

Lines 268 to 271 in 00f1cd3

	if (body.grant_type !== 'authorization_code' && this.settings.clientSecret) {
	const basicAuthStr = btoa(this.settings.clientId + ':' + this.settings.clientSecret);
	headers.Authorization = 'Basic ' + basicAuthStr;
	}

[evert]

I was under the assumption that the secret shouldn't be specified, because this request is usually done by browsers and a clientSecret would be kinda pointless there, but it appears from the specification that this incorrect; which makes sense now given that the request to the /token endpoint could also be done by another server.

So this is a gap in the library, need to fix this!