fix(client): don't send client_id in token body under client_secret_basic - #3159
Closed
SpiliosDimakopoulos wants to merge 1 commit into
Closed
Conversation
Copy link
Copy Markdown
Sorry, something went wrong.
…asic RFC 6749 §2.3: with HTTP Basic auth, client credentials must not also appear in the request body. prepare_token_auth() already stripped client_secret for client_secret_basic but left client_id in, so strict token endpoints (Keycloak, Okta strict mode) saw two authentication methods in one request and rejected it. Strip client_id too. Two existing tests asserted the old behavior explicitly (client_id present in the body) -- updated them to assert its absence instead. Fixes #3138
9 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3138
What
Under token_endpoint_auth_method = client_secret_basic, the OAuth client sends
credentials via Authorization: Basic ... — but prepare_token_auth() only
stripped client_secret from the request body, leaving client_id in. RFC 6749
§2.3 requires that with Basic auth, client credentials not also appear in the
body. Strict token endpoints (Keycloak, Okta in strict mode) reject this as two
authentication methods in a single request.
Fix
One-line change: strip client_id alongside client_secret from the body when
auth_method == "client_secret_basic".
Testing
Two existing tests in tests/client/test_auth.py explicitly asserted the old
(buggy) behavior — assert "client_id=test%40client" in content # client_id still in body. Updated both to assert its absence instead, and added the same
check to the refresh-token test for symmetry.
uv run pytest tests/client/, uv run ruff check ., uv run ruff format --check .,
uv run pyright all pass.
Disclosure
I used AI (Claude) to help draft this fix; I've reviewed and understand the
change and I'm happy to answer questions about it.