oauthparams

var ReservedAuthorizationParams = map[string]bool{
	"response_type":         true,
	"client_id":             true,
	"redirect_uri":          true,
	"scope":                 true,
	"state":                 true,
	"code_challenge":        true,
	"code_challenge_method": true,
	"nonce":                 true,
}

ReservedAuthorizationParams are OAuth2 parameters managed by the framework that must not be set via AdditionalAuthorizationParams.

var ReservedTokenParams = map[string]bool{
	"grant_type":            true,
	"code":                  true,
	"redirect_uri":          true,
	"client_id":             true,
	"client_secret":         true,
	"code_verifier":         true,
	"refresh_token":         true,
	"scope":                 true,
	"client_assertion":      true,
	"client_assertion_type": true,
}

ReservedTokenParams are OAuth2 parameters managed by the framework that must not be set via AdditionalTokenParams. They cover both token-endpoint grant types the framework issues (authorization_code and refresh_token), plus the RFC 7523 client-authentication credentials: letting those through would combine an assertion with the configured client_secret or HTTP Basic credentials into an invalid multi-method client-auth request, and would put a credential in plain configuration instead of a secret-backed path.