Doing self._params.update(self.headers) is the wrong thing.
We already have request.headers available, and we use it.

I suggest to remove this ability to read HTTP headers from request root attributes. If someone want the headers, it uses request.headers['Token'], and not request.token because they MUST be different.

I tag this one "bug" because a HTTP Header must not override the payload attribute.

e.g. curl ../authorize -d redirect_uri=foo -H 'redirect_uri=bar' will use bar instead of foo

I'm not sure I agree with your conclusion. 2 reasons:

• if we apply your logic, there also is request.body and request.url_query so why update _params with them ?
• more importantly, I see that the validators use request attributes (client_id, scopes, etc.). So by doing this, you are removing the possibility of passing OAuth data through headers.

For 1. each _params is an OAuth valid parameter (client_id, redirect_uri, ...). So the logic is to copy all OAuth data coming from body and URL query into the request attributes.

For 2. The only case where I see OAuth data passing through HTTP Headers is OAuth1 via Authorization header, but oauthlib have specific code handling this (see oauth1..base.py ).

Does it make sense ?

I agree we should prevent headers and body/query params overwriting each other.

Re 2. All headers would still be accessible to the validator functions via the request.headers dictionary?

Ok, makes sense.