auth: Deprecate unused client_secret parameter

OAuth2Mixin.authorize_redirect has never used this argument
and similar methods in this module don't have it.

Closes #1122

diff --git a/tornado/auth.py b/tornado/auth.py
index 59501f56b7b4f7cf4e021fadbf1d7e572fae189e..97cfc93adadb22812a9bf2ccf978b87cf1239c66 100644 (file)
--- a/tornado/auth.py
+++ b/tornado/auth.py
@@ -63,6 +63,7 @@ import hmac
 import time
 import urllib.parse
 import uuid
+import warnings
 
 from tornado import httpclient
 from tornado import escape
@@ -571,7 +572,13 @@ class OAuth2Mixin(object):
 
            The ``callback`` argument and returned awaitable were removed;
            this is now an ordinary synchronous function.
+
+        .. deprecated:: 6.4
+           The ``client_secret`` argument (which has never had any effect)
+           is deprecated and will be removed in Tornado 7.0.
         """
+        if client_secret is not None:
+            warnings.warn("client_secret argument is deprecated", DeprecationWarning)
         handler = cast(RequestHandler, self)
         args = {"response_type": response_type}
         if redirect_uri is not None:

diff --git a/tornado/test/auth_test.py b/tornado/test/auth_test.py
index 3cd715f7336fcbea20e0f00ae426125a47d321d6..5eddb9803cd78f9f08689206cbf2c4b36b9d6100 100644 (file)
--- a/tornado/test/auth_test.py
+++ b/tornado/test/auth_test.py
@@ -550,7 +550,6 @@ class GoogleLoginHandler(RequestHandler, GoogleOAuth2Mixin):
             self.authorize_redirect(
                 redirect_uri=self._OAUTH_REDIRECT_URI,
                 client_id=self.settings["google_oauth"]["key"],
-                client_secret=self.settings["google_oauth"]["secret"],
                 scope=["profile", "email"],
                 response_type="code",
                 extra_params={"prompt": "select_account"},