Module: Hitch::OauthFormAdmission
- Extended by:
- ActiveSupport::Concern
- Includes:
- RequestAdmission
- Included in:
- ActivationsController, AuthorizationsController, DeviceAuthorizationsController, RevocationsController, TokensController
- Defined in:
- app/controllers/concerns/hitch/oauth_form_admission.rb
Overview
Rails records request.filtered_parameters before controller callbacks.
For OAuth form endpoints that would let Rack parse an unbounded credential
body before a conventional body-limit callback could run. This concern sits
earlier in the process_action chain, caps the raw stream, and installs a
deliberately minimal body-parameter cache for Rails instrumentation.
Endpoint actions still parse the bounded raw form through OauthRequestParameters, preserving duplicate and structured-key evidence. The browser-backed consent POST retains only its CSRF token in Rails params; public token and revocation endpoints expose no body fields to instrumentation.