{"action":"opened","issue":{"url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/521","labels_url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/521/labels{/name}","comments_url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/521/comments","events_url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/521/events","html_url":"https://github.com/bshaffer/oauth2-server-php/issues/521","id":58177401,"number":521,"title":"Grant type restriction for client should be validated before grant type itself","user":{"login":"AidasK","id":2088484,"avatar_url":"https://avatars.githubusercontent.com/u/2088484?v=3","gravatar_id":"","url":"https://api.github.com/users/AidasK","html_url":"https://github.com/AidasK","followers_url":"https://api.github.com/users/AidasK/followers","following_url":"https://api.github.com/users/AidasK/following{/other_user}","gists_url":"https://api.github.com/users/AidasK/gists{/gist_id}","starred_url":"https://api.github.com/users/AidasK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AidasK/subscriptions","organizations_url":"https://api.github.com/users/AidasK/orgs","repos_url":"https://api.github.com/users/AidasK/repos","events_url":"https://api.github.com/users/AidasK/events{/privacy}","received_events_url":"https://api.github.com/users/AidasK/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-02-19T07:51:03Z","updated_at":"2015-02-19T07:51:03Z","closed_at":null,"body":"Grant type restriction validation should go before request validation:\r\nGrant type validation after request validation:\r\nhttps://github.com/bshaffer/oauth2-server-php/blob/develop/src/OAuth2/Controller/TokenController.php#L142\r\n\r\nhttps://github.com/bshaffer/oauth2-server-php/blob/develop/src/OAuth2/Controller/TokenController.php#L124\r\n\r\nThis is an issue, because `password` grant type can be still be used to validate password, even though it is restricted.  "}}