[CXF-4427] Error details are discarded and never sent to the client

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.7
• Fix Version/s: 2.6.2, 2.7
• Component/s: JAX-RS Security
• Labels: oauth2
• Estimated Complexity: Novice
• Assignee: Sergey Beryozkin
• Reporter: Jordi Gerona
• Created: 16/Jul/12 16:21
• Updated: 28/Aug/12 17:44
• Resolved: 17/Jul/12 11:30

Description

Current AccessTokenService implementation catches all OAuthServiceExceptions and returns a generic error response discarding all the exception details:

ServerAccessToken serverToken = null;
try

{ serverToken = handler.createAccessToken(client, params); }

catch (OAuthServiceException ex)

{ // the error response is to be returned next }

if (serverToken == null)

{ return createErrorResponse(params, OAuthConstants.INVALID_GRANT); }

I think it would be more useful to create the OAuthError object to return using the exception's message, in order to receive the error code/details at the client layer