Replace Controller.Json() by ControllerBase.BadRequest() to return a 400 response for invalid token requests

README.md

@@ -156,14 +156,16 @@ To **support the password or the client credentials flow, you must provide your
 
 ```csharp
 [HttpPost("~/connect/token")]
+[Produces("application/json")]
 public async Task<IActionResult> Exchange() {
     var request = HttpContext.GetOpenIdConnectRequest();
 
     if (request.IsPasswordGrantType()) {
         var user = await _userManager.FindByNameAsync(request.Username);
         if (user == null) {
-            return Json(new OpenIdConnectResponse {
+            return BadRequest(new OpenIdConnectResponse {
-                Error = OpenIdConnectConstants.Errors.InvalidGrant
+                Error = OpenIdConnectConstants.Errors.InvalidGrant,
+                ErrorDescription = "The username/password couple is invalid."
             });
         }
 
@@ -173,8 +175,9 @@ public async Task<IActionResult> Exchange() {
                 await _userManager.AccessFailedAsync(user);
             }
 
-            return Json(new OpenIdConnectResponse {
+            return BadRequest(new OpenIdConnectResponse {
-                Error = OpenIdConnectConstants.Errors.InvalidGrant
+                Error = OpenIdConnectConstants.Errors.InvalidGrant,
+                ErrorDescription = "The username/password couple is invalid."
             });
         }
 
@@ -196,8 +199,9 @@ public async Task<IActionResult> Exchange() {
         return SignIn(ticket.Principal, ticket.Properties, ticket.AuthenticationScheme);
     }
 
-    return Json(new OpenIdConnectResponse {
+    return BadRequest(new OpenIdConnectResponse {
-        Error = OpenIdConnectConstants.Errors.UnsupportedGrantType
+        Error = OpenIdConnectConstants.Errors.UnsupportedGrantType,
+        ErrorDescription = "The specified grant type is not supported."
     });
 }
 ```

samples/Mvc.Server/Controllers/AuthorizationController.cs

@@ -124,14 +124,16 @@ namespace Mvc.Server {
         // Note: to support the password grant type, you must provide your own token endpoint action:
 
         // [HttpPost("~/connect/token")]
+        // [Produces("application/json")]
         // public async Task<IActionResult> Exchange() {
         //     var request = HttpContext.GetOpenIdConnectRequest();
         // 
         //     if (request.IsPasswordGrantType()) {
         //         var user = await _userManager.FindByNameAsync(request.Username);
         //         if (user == null) {
-        //             return Json(new OpenIdConnectResponse {
+        //             return BadRequest(new OpenIdConnectResponse {
-        //                 Error = OpenIdConnectConstants.Errors.InvalidGrant
+        //                 Error = OpenIdConnectConstants.Errors.InvalidGrant,
+        //                 ErrorDescription = "The username/password couple is invalid."
         //             });
         //         }
         // 
@@ -141,8 +143,9 @@ namespace Mvc.Server {
         //                 await _userManager.AccessFailedAsync(user);
         //             }
         // 
-        //             return Json(new OpenIdConnectResponse {
+        //             return BadRequest(new OpenIdConnectResponse {
-        //                 Error = OpenIdConnectConstants.Errors.InvalidGrant
+        //                 Error = OpenIdConnectConstants.Errors.InvalidGrant,
+        //                 ErrorDescription = "The username/password couple is invalid."
         //             });
         //         }
         // 
@@ -164,8 +167,9 @@ namespace Mvc.Server {
         //         return SignIn(ticket.Principal, ticket.Properties, ticket.AuthenticationScheme);
         //     }
         // 
-        //     return Json(new OpenIdConnectResponse {
+        //     return BadRequest(new OpenIdConnectResponse {
-        //         Error = OpenIdConnectConstants.Errors.UnsupportedGrantType
+        //         Error = OpenIdConnectConstants.Errors.UnsupportedGrantType,
+        //         ErrorDescription = "The specified grant type is not supported."
         //     });
         // }
     }