fix: Handle malformed auth header

[bgrant]

• Handle "Malformed authorization header" ValueError that bubbles up from oauthlib the same way we handle other oauth errors

• Fix a docstring typo

• Update CHANGELOG.md

• Update README.md (as needed)

• New dependencies were added to pyproject.toml

• pip install succeeds with a clean virtualenv

• There are new or modified tests that cover changes

• Test coverage is maintained or expanded

[smholloway]

👍 Nice!

[demianbrecht]

Does this raise a different exception type? I'm thinking that we won't be able to differentiate between missing auth headers and malformed ones anymore, something that I'm pretty sure we'll still want.

[bgrant]

Here's the path I went down here:

1. A "Malformed authorization header" currently raises a ValueError from oauthlib which is not caught anywhere: oauthlib:parse_authorization_header
2. DDA attempts to massage most OAuth errors into "those specified in the OAuth Problem Reporting proposal", here, which is what our service expects in the place this bubbles up
3. Looking through that list of errors, I figured OAuthMissingParameterError was still the best fit in this case.

Do we currently detect a missing Authorization header intelligently?

[bgrant]

In this case it's missing all the needed parameters, and so the error lists them all.

[demianbrecht]

Right, so that would work in this case. However, if there's a case where we're getting an invalid auth header (anything that doesn't conform explicitly to OAuth as defined here), it'll get swallowed up as a missing error. I think those two cases should be distinguished from one another.

Optimally, I think that oauthlib would report oauth_parameters_rejected (defined in OAuth error reporting) rather than simply a ValueError but it wasn't implemented that way. I think that the best thing to do would be to add support for token_revoked in build_error and handle that case when we get a ValueError from collect_parameters. That way, the caller can clearly see the difference between missing and invalid parameters.

We can also add an explicit check for all parameters missing case you mentioned here too in order to catch that case.

[bgrant]

After discussion in Slack - I'm returning parameter_rejected