Documentation on setting/generating oauth_verifier missing #22
Description
There is no documentation that tells one how to set or generate an oauth_verifier, but creating a random verifier and validating it is crucial to security. Additionally, in the Provider example on GoogleCode, there is no OAuth10AInspector added, which is UTMOST important to include, else the whole service can be compromised (as only the OAuth10AInspector verifies that the Verifier is actually the one in the token store). Without this Inspector, a client could just invent a verifier and would get (falsely) authenticated.
I've went through the code and I can't find any place where the IToken.Verifier field is generated/set (except when it is retrived to the POST data/Headers). I thus use the following in my code to store a Verifier (in the authorize step):
var context = new OAuthContextBuilder ().FromUri (Request.HttpMethod, Request.Url);
var token = OAuthHandler.RequestTokens.GetToken (context.Token);
token.Verifier = Guid.NewGuid ().ToString ();
Please provide a better documentation regarding
a) Incldue a note that provider implementation must ALWAYS have OAuth10AInspector present
b) How to generate a oauth_verifier and storing it in the request token store