client_secret (if defined) is passed as a parameter to authorization URL

[jasoncpatton]

If a client has set a client_secret in their ClientConfig object, when getAuthorizerUrl() builds the authorization URL from clientConfig->getParams(), the client_secret is added to the parameter list. This exposes the client_secret to users of the client when they are sent to an OAuth2 authorization endpoint. The client_secret should only be added to a request to an OAuth2 token endpoint.

oauth2-client-php/src/EasyBib/OAuth2/Client/AuthorizationCodeGrant/AuthorizationCodeSession.php

Lines 69 to 74 in e3cc805

	protected function getAuthorizeUrl()
	{
	$params = [
	'response_type' => 'code',
	'state' => $this->stateStore->getState(),
	] + $this->clientConfig->getParams();