Repository navigation
Incorrect check for insecure transport on OAuth1.0 #627
Description
Describe the bug
The current implementation of OAuth1Request checks for insecure transport which is incorrect. OAuth 1 is protocol-independent and it does not depend on TLS layer to secure the communication. This check is only necessary during OAuth 2 communication.
Additionally, the error description mentions OAuth 2 which indicates that this class was accidentally copied over from OAuth 2 implementation.
Expected behavior
OAuth1Request does not check for insecure transport and the InsecureTransportError is removed.
Activity
RavSinghChandan commentedon Aug 4, 2026
Both parts of this still hold — OAuth1Request.init calls
InsecureTransportError.check(uri), and the description on that error class still
reads "OAuth 2 MUST utilize https." on an OAuth1 error.
The wording is an easy fix. The check itself is trickier, since dropping it
means anyone relying on that error stops getting it, so it's a behaviour change
rather than a straight bug fix.
Would you want those split — fix the description now, and deprecate the check
over a release? Or just take it out in one go? Happy to do either, just didn't
want to pick for you.