A little binding element cleanup.

2 files changed, 13 insertions, 15 deletions

diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/AccessRequestBindingElement.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/AccessRequestBindingElement.cs
index 0533527..639e4f5 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/AccessRequestBindingElement.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/AccessRequestBindingElement.cs
@@ -18,7 +18,7 @@ namespace DotNetOpenAuth.OAuth2.ChannelElements {
 	using DotNetOpenAuth.OAuth2.Messages;
 
 	/// <summary>
-	/// Decodes authorization codes, refresh tokens and access tokens on incoming messages.
+	/// Decodes authorization codes and refresh tokens on incoming messages.
 	/// </summary>
 	/// <remarks>
 	/// This binding element also ensures that the code/token coming in is issued to
@@ -109,6 +109,15 @@ namespace DotNetOpenAuth.OAuth2.ChannelElements {
 		[SuppressMessage("Microsoft.Naming", "CA2204:Literals should be spelled correctly", MessageId = "authorizationexpired", Justification = "Protocol requirement")]
 		[SuppressMessage("Microsoft.Globalization", "CA1303:Do not pass literals as localized parameters", MessageId = "DotNetOpenAuth.Messaging.ErrorUtilities.VerifyProtocol(System.Boolean,System.String,System.Object[])", Justification = "Protocol requirement")]
 		public override MessageProtections? ProcessIncomingMessage(IProtocolMessage message) {
+			var authenticatedClientRequest = message as AuthenticatedClientRequestBase;
+			if (authenticatedClientRequest != null) {
+				// Check that the client secret is correct.
+				var client = this.AuthorizationServer.GetClientOrThrow(authenticatedClientRequest.ClientIdentifier);
+				string secret = client.Secret;
+				ErrorUtilities.VerifyProtocol(!string.IsNullOrEmpty(secret), Protocol.unauthorized_client); // an empty secret is not allowed for client authenticated calls.
+				ErrorUtilities.VerifyProtocol(MessagingUtilities.EqualsConstantTime(secret, authenticatedClientRequest.ClientSecret), Protocol.incorrect_client_credentials);
+			}
+
 			var tokenRequest = message as IAuthorizationCarryingRequest;
 			if (tokenRequest != null) {
 				try {
@@ -158,12 +167,6 @@ namespace DotNetOpenAuth.OAuth2.ChannelElements {
 					// Make sure the client sending us this token is the client we issued the token to.
 					ErrorUtilities.VerifyProtocol(string.Equals(accessRequest.ClientIdentifier, tokenRequest.AuthorizationDescription.ClientIdentifier, StringComparison.Ordinal), Protocol.incorrect_client_credentials);
 
-					// Check that the client secret is correct.
-					var client = this.AuthorizationServer.GetClientOrThrow(accessRequest.ClientIdentifier);
-					string secret = client.Secret;
-					ErrorUtilities.VerifyProtocol(!string.IsNullOrEmpty(secret), Protocol.unauthorized_client); // an empty secret is not allowed for client authenticated calls.
-					ErrorUtilities.VerifyProtocol(MessagingUtilities.EqualsConstantTime(secret, accessRequest.ClientSecret), Protocol.incorrect_client_credentials);
-
 					var scopedAccessRequest = accessRequest as ScopedAccessTokenRequest;
 					if (scopedAccessRequest != null) {
 						// Make sure the scope the client is requesting does not exceed the scope in the grant.
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/AccessTokenBindingElement.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/AccessTokenBindingElement.cs
index 7c1e21e..a77fe44 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/AccessTokenBindingElement.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/AccessTokenBindingElement.cs
@@ -60,18 +60,13 @@ namespace DotNetOpenAuth.OAuth2.ChannelElements {
 				return MessageProtections.None;
 			}
 
-			AccessTokenParameters parameters = null;
-			var accessTokenRequest = request as IAccessTokenRequestInternal;
-			if (accessTokenRequest != null) {
-				parameters = accessTokenRequest.AccessTokenCreationParameters;
-			}
-
 			var accessTokenResponse = message as AccessTokenSuccessResponse;
 			if (accessTokenResponse != null) {
-				ErrorUtilities.VerifyInternal(parameters != null, "Unexpected request type.");
+				var accessTokenRequest = request as IAccessTokenRequestInternal;
+				ErrorUtilities.VerifyInternal(accessTokenRequest != null, MessagingStrings.UnexpectedMessageReceived, typeof(IAccessTokenRequestInternal), request.GetType());
 				var authCarryingRequest = (IAuthorizationCarryingRequest)request;
 				var accessToken = new AccessToken(authCarryingRequest.AuthorizationDescription, accessTokenResponse.Lifetime);
-				var accessTokenFormatter = AccessToken.CreateFormatter(this.AuthorizationServer.AccessTokenSigningKey, parameters.ResourceServerEncryptionKey);
+				var accessTokenFormatter = AccessToken.CreateFormatter(this.AuthorizationServer.AccessTokenSigningKey, accessTokenRequest.AccessTokenCreationParameters.ResourceServerEncryptionKey);
 				accessTokenResponse.AccessToken = accessTokenFormatter.Serialize(accessToken);
 
 				if (accessTokenResponse.HasRefreshToken) {