oauth_verifier isnt't sent in Authorization header (access token phase) about tmhoauth

[spacenick]

I have to specify that I'm using the oauth_flow.php file to test it, and everything runs fine untill there!

[spacenick]

Adding this after line 266ish makes the trick :

if (isset($_signing_params['oauth_verifier'])) {
$this->auth_params['oauth_verifier'] = $_signing_params['oauth_verifier'];
unset($_signing_params['oauth_verifier']);
}

Just wondering why it wasn't doing it by default since sending oauth_verifier in the Authorization header is in the OAuth 1.0a last spec, maybe I did something wrong

[themattharris]

Thanks, the Twitter API is fairly lenient on where the parameters are located (header or GET/POST params) but it's still better to be correct. I'll add the code to ensure oauth_verifier (when set) is in the authorization header and push a new version up.

I have a few other hardening changes that i'm adding at the moment but I expect to push the new version within the week. When I do i'll close the issue.

[themattharris]

Just pushed that change with v0.60 so i'm closing this issue. Thanks again. (Props are in the readme ;) )