From 4a57ac87abcb37d852c83e7079e28c19ff98eaf9 Mon Sep 17 00:00:00 2001
From: Ben Darnell <ben@bendarnell.com>
Date: Mon, 19 Jun 2023 15:54:01 -0400
Subject: [PATCH] auth: Deprecate unused client_secret parameter

OAuth2Mixin.authorize_redirect has never used this argument
and similar methods in this module don't have it.

Closes #1122
---
 tornado/auth.py           | 7 +++++++
 tornado/test/auth_test.py | 1 -
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/tornado/auth.py b/tornado/auth.py
index 59501f56..97cfc93a 100644
--- a/tornado/auth.py
+++ b/tornado/auth.py
@@ -63,6 +63,7 @@ import hmac
 import time
 import urllib.parse
 import uuid
+import warnings
 
 from tornado import httpclient
 from tornado import escape
@@ -571,7 +572,13 @@ class OAuth2Mixin(object):
 
            The ``callback`` argument and returned awaitable were removed;
            this is now an ordinary synchronous function.
+
+        .. deprecated:: 6.4
+           The ``client_secret`` argument (which has never had any effect)
+           is deprecated and will be removed in Tornado 7.0.
         """
+        if client_secret is not None:
+            warnings.warn("client_secret argument is deprecated", DeprecationWarning)
         handler = cast(RequestHandler, self)
         args = {"response_type": response_type}
         if redirect_uri is not None:
diff --git a/tornado/test/auth_test.py b/tornado/test/auth_test.py
index 3cd715f7..5eddb980 100644
--- a/tornado/test/auth_test.py
+++ b/tornado/test/auth_test.py
@@ -550,7 +550,6 @@ class GoogleLoginHandler(RequestHandler, GoogleOAuth2Mixin):
             self.authorize_redirect(
                 redirect_uri=self._OAUTH_REDIRECT_URI,
                 client_id=self.settings["google_oauth"]["key"],
-                client_secret=self.settings["google_oauth"]["secret"],
                 scope=["profile", "email"],
                 response_type="code",
                 extra_params={"prompt": "select_account"},
-- 
GitLab