Oauth2-server: What hint message should we use to identify a failed authentication of user?

[yob-yob]

Please read pull request #967 to fully understand the reason for this issue

Hi, I already did the research and yes, I found out that this does conform to the OAuth 2 specs

BUT!...

can we put a hint on this? I could see that the exception returns this

• error
• error_description
• hint
• message

but the hint data is empty. if we could use this, then it would be easy for devs to know that the credentials are incorrect or maybe a user was not found or even a user authentication failed message.

src/Grant/PasswordGrant.php

since this file handles this error ( Line:102 - Line:106 ) we could easily identify that the error occurred because of a Failed Authentication of User.

QUESTION IS: what should be the message?

_Originally posted by @yob-yob in https://github.com/thephpleague/oauth2-server/pull/967#issuecomment-590925988_

[Sephster]

I've added a hint now which will be released in version 9. I don't have a timescale for this being released at present. If you are desperate for this notification, I would recommend using the event that is also issued as a stop gap in the meantime. Thanks for your suggestion.

[Sephster]

I have decided to revert this change. The hint is usually returned in the exception so there is a chance it could be exposed to the end user. This could be a security concern as the specs deliberately obfuscate the reason for the error to reduce the attack surface.

Because we have an event for this, I think it would be best implementers use the event instead and log this in their application log. Sorry for this @yob-yob but I hope you understand my reasoning. Many thanks.

[HenrijsS]

As you reverted this change, what would now be the best method on differentiating Invalid request between invalid credentials? I was just following some Laravel passport tutorials and this update makes the verification part of the tutorials obsolete.

[Sephster]

@HenrijsS I would recommend using the event and logging it

[HenrijsS]

@HenrijsS I would recommend using the event and logging it

Turns out the problem was that even though specifying the APP_URL, it doesn't store the token when using NPM Browsersync.
Going back to the local url works but I just have to refresh the page manually every time I make code changes which is a bummer but not a dealbraker.