Merge pull request #428 from asherf/github

[Github] Pass access token in a header.

CHANGELOG.md

@@ -19,6 +19,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 - Use `unidecode` to cleanup usernames from unicode characters
 - Update Twitch API support from v3 to v5
 - Properly setup `pytest` version for Python2 and Python3
+- Github: pass access token in a header instead of in a query parameter.
 
 ## [3.2.0](https://github.com/python-social-auth/social-core/releases/tag/3.2.0) - 2019-05-30
 

social_core/backends/github.py

@@ -65,7 +65,7 @@ def user_data(self, access_token, *args, **kwargs):
 
     def _user_data(self, access_token, path=None):
         url = urljoin(self.api_url(), 'user{0}'.format(path or ''))
-        return self.get_json(url, params={'access_token': access_token})
+        return self.get_json(url, headers={'Authorization': 'token {0}'.format(access_token)})
 
 
 class GithubMemberOAuth2(GithubOAuth2):
@@ -76,10 +76,9 @@ def user_data(self, access_token, *args, **kwargs):
         user_data = super(GithubMemberOAuth2, self).user_data(
             access_token, *args, **kwargs
         )
+        headers = {'Authorization': 'token {0}'.format(access_token)}
         try:
-            self.request(self.member_url(user_data), params={
-                'access_token': access_token
-            })
+            self.request(self.member_url(user_data), headers=headers)
         except HTTPError as err:
             # if the user is a member of the organization, response code
             # will be 204, see http://bit.ly/ZS6vFl