Add workaround for Facebook oauth bug to oauth2 package

[DartBot]

<img src="https://avatars.githubusercontent.com/u/336447?v=3" align="left" width="96" height="96"hspace="10"> Issue by MaxHorstmann
Originally opened as dart-lang/sdk#12366

---

Facebook's oauth2 implementation has a bug. It returns the access token as plain text (text/plain) instead of json (application/json).

See e.g. http://stackoverflow.com/questions/3862108/facebook-oauth-access-token-missing

Unforunately, this breaks the oauth2 package (http://pub.dartlang.org/packages/oauth2) right here: https://code.google.com/p/dart/codesearch#dart/trunk/dart/pkg/oauth2/lib/src/handle_access_token_response.dart&amp;l=37

Ideally Faceboook should fix this return json like the oauth2 spec says, but well, so far they haven't done so.

Since Facebook sign-in is a fairly common use case, my suggestion is to add some flexibility here and handle both a json or plaintext response. The plaintext response string looks like this:

access_token=CAAC9nzmHiUwBAE36sC6fPvDOtlZAFGfoLEfZAcfS2VnEOyo7ZCvckG55tCvzwRQNuSl2unMpFYxxxxxdostdNU38grYyEVSIUe2MhIWXII0ufc380vUc56B6cYAtli153PKuEZA1BT44AoyrtQTc3UT6meZAiO1YZD&expires=5181866

[DartBot]

<img src="https://avatars.githubusercontent.com/u/336447?v=3" align="left" width="48" height="48"hspace="10"> Comment by MaxHorstmann

---

Here's how I fixed it locally: https://gist.github.com/MaxHorstmann/6207756

[DartBot]

<img src="https://avatars.githubusercontent.com/u/3276024?v=3" align="left" width="48" height="48"hspace="10"> Comment by anders-sandholm

---

Removed Type-Defect label.
Added Type-Enhancement, Area-Pkg, Triaged labels.

[DartBot]

<img src="https://avatars.githubusercontent.com/u/5479?v=3" align="left" width="48" height="48"hspace="10"> Comment by sethladd

---

Added Pkg-OAuth2, AssumedStale labels.

[DartBot]

<img src="https://avatars.githubusercontent.com/u/188?v=3" align="left" width="48" height="48"hspace="10"> Comment by nex3

---

Added Triaged label.

[nex3]

@MaxHorstmann I'd accept a patch that added support for a text/plain response.

[nex3]

Actually, better would be to add a single flag that enabled all of Facebooks weird noncompliant tweaks (see also #308).

[thosakwe]

I would be more than happy to submit a PR to resolve this issue. The requirement of a JSON response isn't obeyed by Github, either, so it's not possible to access it using this package (yet!).

[nex3]

@thosakwe A PR would definitely be appreciated!

[thosakwe]

With the new changes, a response like this:

access_token=CAAC9nzmHiUwBAE36sC6fPvDOtlZAFGfoLEfZAcfS2VnEOyo7ZCvckG55tCvzwRQNuSl2unMpFYxxxxxdostdNU38grYyEVSIUe2MhIWXII0ufc380vUc56B6cYAtli153PKuEZA1BT44AoyrtQTc3UT6meZAiO1YZD&expires=5181866

can be handled like this:

await grant.handleAccessTokenResponse(..., getParameters: (contentType, body) {
  return Uri.splitQueryString(body);
});