client_secret is optional in all grant types

[Tobion]

The client ID is considered public information, and is used to build login URLs, or included in Javascript source code on a page. The client secret must be kept confidential. If a deployed app cannot keep the secret confidential, such as single-page Javascript apps or native apps, then the secret is not used, and ideally the service shouldn't issue a secret to these types of apps in the first place.

https://aaronparecki.com/oauth-2-simplified/

When there is no client_secret you also must not send one (in our case pivotal cloudfoundry oauth). But the current validation makes this impossible.

[mweibel]

@dm ping? :)

[dm]

Hi @mweibel @Tobion, I've since left Sainsbury's, but I'll try to ping someone there to look at this.
Cheers,
Dan

[pharman]

Hi @Tobion - could you add a note on the readme about this and add a simple test case?

[Tobion]

I updated the readme and the tests which fixes #8 and #10 as well.

[Tobion]

@pharman please merge

[pharman]

Thanks @Tobion

[pharman]

https://github.com/Sainsburys/guzzle-oauth2-plugin/releases/tag/v3.0.3

[Tobion]

Thank you