providers/oauth2: decode percent-encoded basic auth#20779
Merged
BeryJu merged 4 commits intogoauthentik:mainfrom Mar 7, 2026
Merged
providers/oauth2: decode percent-encoded basic auth#20779BeryJu merged 4 commits intogoauthentik:mainfrom
BeryJu merged 4 commits intogoauthentik:mainfrom
Conversation
Fixes goauthentik#20739 Decode percent-encoded client credentials from HTTP Basic authentication before provider lookup while preserving existing behavior for raw plus characters. Add unit and endpoint coverage for encoded client IDs and client secrets.
✅ Deploy Preview for authentik-integrations ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for authentik-storybook ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for authentik-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
BeryJu
approved these changes
Mar 7, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #20779 +/- ##
==========================================
- Coverage 93.43% 93.39% -0.05%
==========================================
Files 983 983
Lines 55608 55644 +36
==========================================
+ Hits 51960 51967 +7
- Misses 3648 3677 +29
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
authentik-automation bot
pushed a commit
that referenced
this pull request
Mar 7, 2026
Fixes #20739 Decode percent-encoded client credentials from HTTP Basic authentication before provider lookup while preserving existing behavior for raw plus characters. Add unit and endpoint coverage for encoded client IDs and client secrets.
Contributor
|
🍒 Cherry-pick to |
BeryJu
pushed a commit
that referenced
this pull request
Mar 7, 2026
… to version-2026.2) (#20781) providers/oauth2: decode percent-encoded basic auth (#20779) Fixes #20739 Decode percent-encoded client credentials from HTTP Basic authentication before provider lookup while preserving existing behavior for raw plus characters. Add unit and endpoint coverage for encoded client IDs and client secrets. Co-authored-by: Oluwatobi Mustapha <oluwatobimustapha539@gmail.com>
kensternberg-authentik
added a commit
that referenced
this pull request
Mar 10, 2026
* main: (23 commits) web: CodeSpell -> CSpell migration (#20188) core: bump goauthentik.io/api/v3 to 3.2026.5.0-rc1-1773052201 (#20801) core: bump github.com/go-openapi/runtime from 0.29.2 to 0.29.3 (#20787) core: bump golang.org/x/sync from 0.19.0 to 0.20.0 (#20788) web: bump the storybook group across 1 directory with 5 updates (#20794) core: bump golang.org/x/oauth2 from 0.35.0 to 0.36.0 (#20789) core: bump goauthentik/selenium from 145.0-ak-0.40.3 to 145.0-ak-0.40.5 in /tests/e2e (#20790) core: bump black from 26.1.0 to 26.3.0 (#20791) core: bump cachetools from 7.0.3 to 7.0.4 (#20792) core: bump goauthentik/fips-python from `38c4dd2` to `b481db2` in /lifecycle/container (#20796) web: bump @rollup/plugin-commonjs from 29.0.1 to 29.0.2 in /web in the rollup group across 1 directory (#20795) core: bump astral-sh/uv from 0.10.8 to 0.10.9 in /lifecycle/container (#20797) core: bump goauthentik/fips-debian from `4966b90` to `6c9197b` in /lifecycle/container (#20798) web: bump @types/node from 25.3.3 to 25.3.5 in /web (#20799) web: bump knip from 5.85.0 to 5.86.0 in /web (#20800) enterprise/endpoints/connectors: add google_chrome (#19129) providers/oauth2: decode percent-encoded basic auth (#20779) web: bump immutable from 5.1.4 to 5.1.5 in /web (#20720) web: bump the storybook group across 1 directory with 5 updates (#20731) web: bump @rollup/plugin-commonjs from 29.0.0 to 29.0.1 in /web in the rollup group across 1 directory (#20732) ...
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #20739
Details
extract_client_auth()now percent-decodes RFC 6749 form-encodedclient_idandclient_secretafter Base64-decoding the HTTP Basic credential pair. It usesurllib.parse.unquoteinstead ofunquote_plusso existing clients that send raw+characters keep their current behavior.Added coverage for:
client_idon the device backchannel endpointclient_secreton the token endpoint+in existing Basic auth credentialsChecklist
authentik/providers/oauth2/testspasses