authorize_access_token doesn't raise MissingCodeException when code parameter missing

**Describe the bug**

`authorize_access_token` assigns `params["code"]` to `None` when the request parameter `code` is missing. For example, the Flask integration:

https://github.com/authlib/authlib/blob/772a7149adc6192ae3d3e7d0f3a02d6edaf385a8/authlib/integrations/flask_client/apps.py#L82-L101

This means that it then bypasses the check in `prepare_token_request` as the key is present:

https://github.com/authlib/authlib/blob/772a7149adc6192ae3d3e7d0f3a02d6edaf385a8/authlib/oauth2/rfc6749/parameters.py#L95-L96

This appears to apply to Django and Starlette integration too.

**Error Stacks**

No error is raised.

**To Reproduce**

The [authorize route example](https://docs.authlib.org/en/latest/client/flask.html#routes-for-authorization) when the `code` query string parameter is missing:

```python
token = oauth.twitter.authorize_access_token()
```

**Expected behavior**

`MissingCodeException` is raised.

**Environment:**

 - OS: Ubuntu 22.04.5
 - Python Version: 3.13.5
 - Authlib Version: 1.6.0

**Additional context**

N/A


	def authorize_access_token(self, **kwargs):
	"""Fetch access token in one step.

	:return: A token dict.
	"""
	if request.method == "GET":
	error = request.args.get("error")
	if error:
	description = request.args.get("error_description")
	raise OAuthError(error=error, description=description)

	params = {
	"code": request.args.get("code"),
	"state": request.args.get("state"),
	}
	else:
	params = {
	"code": request.form.get("code"),
	"state": request.form.get("state"),
	}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

authorize_access_token doesn't raise MissingCodeException when code parameter missing #777

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	if grant_type == "authorization_code" and "code" not in kwargs:
	raise MissingCodeException()

Uh oh!

authorize_access_token doesn't raise MissingCodeException when code parameter missing #777

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions