Why can't we add bad providers ourself?

[jerbob92]

I'm currently trying to implement a provider that did not follow the spec.
Currently the only way to get it working is by creating a fork and add it to the bad providers list.

The code tells me the following:

    // Assume the provider implements the spec properly
    // otherwise. We can add more exceptions as they're
    // discovered. We will _not_ be adding configurable hooks
    // to this package to let users select server bugs.

Why is this? I think there are many broken providers, is it really worth adding them all to the list by MR?

My suggestion is adding a HasBrokenAuthHeader field on the oauth2.Endpoint type.
Another option is adding a AuthorizeLocation field on the oauth2.Endpoint type, the value could be header or query.

[cnbuff410]

Refer to lengthy discussion about this topic here:

#111

[jerbob92]

Thanks, I missed that one!