Ask Claude whether token requests can be JSON.

prompt: In `handleTokenRequest()`, the request is allowed to be JSON or FormData. Does the OAuth spec actually specify both of these as options?

Claude "researched" the topic (including attempting to curl the current OAuth 2.1 draft, but apparently curl is blocked by the Claude Code tool "for security reasons"), then said:

```
  Based on my research, the current implementation in handleTokenRequest() accepts both JSON and form-urlencoded formats for token requests,
   but this doesn't comply with the OAuth specifications:

  1. RFC 6749 (OAuth 2.0) Section 2.3 specifically states:
  The client MUST use the "application/x-www-form-urlencoded" format as defined by W3C.HTML 4.01 Specification with a character encoding of
  UTF-8 in the HTTP request entity-body.
  2. The OAuth 2.1 draft maintains this requirement.

  To strictly follow the OAuth specs, the implementation should only accept application/x-www-form-urlencoded content type for token
  requests and should return an error for other content types.

  Would you like me to modify the code to make it strictly compliant with the OAuth specification?
```

prompt: Yes

Author: kentonv

oauth-provider.ts

@@ -822,14 +822,20 @@ class OAuthProviderImpl {
     let contentType = request.headers.get('Content-Type') || '';
     let body: any = {};
 
-    if (contentType.includes('application/json')) {
-      body = await request.json();
-    } else {
-      // Assume application/x-www-form-urlencoded
-      const formData = await request.formData();
-      for (const [key, value] of formData.entries()) {
-        body[key] = value;
-      }
+    // According to OAuth 2.0 RFC 6749 Section 2.3, token requests MUST use 
+    // application/x-www-form-urlencoded content type
+    if (!contentType.includes('application/x-www-form-urlencoded')) {
+      return createErrorResponse(
+        'invalid_request',
+        'Content-Type must be application/x-www-form-urlencoded',
+        400
+      );
+    }
+
+    // Process application/x-www-form-urlencoded
+    const formData = await request.formData();
+    for (const [key, value] of formData.entries()) {
+      body[key] = value;
     }
 
     // Authenticate client