为什么我会获得访问令牌？ （OAuth2用户）

Question

I'm using OAuth2. Since it's a two step verification, shouldn't it give me an error when I try to make the following request? I haven't specified the client secret, but it still is sending back an access token that works to use.

http://localhost/oauth/authorize/?response_type=token&client_id=myclientid&redirect_uri=http%3A%2F%2Flocalhost%2Fmyredirecturi.php

I understand that I first need to ask for a request token, and then trade that in for an access token, but every time I make this request I get back an access token that works..? Although, I get an error message if I specify the wrong client id.

Answer 1

Looks like I forgot to disable the allowed implicit grant type. :) Works now.