Describe the bug
We're trying to integrate Signicat OpenID with Basic auth and get this message:
{
statusCode: 400,
data: '{"error":"invalid_request","error_description":"Your client is configured to authenticate using CLIENT_SECRET_BASIC"}'
}
This is because client_secret is sent as post data here, even if its null or undefined:
|
const postData = querystring.stringify(params) |
With empty client secret (note the: &client_secret=):
// formData is: grant_type=authorization_code&client_id=client_id&client_secret=&code=code&redirect_uri=uri
{
statusCode: 400,
data: `{"error":"invalid_request","error_description":"Form body malformed! (Body is not a set of key-value pairs separated by '=', delimited by '&' characters)"}`
}Here are some possible solutions:
if (!params.client_secret) {
if (provider.clientSecretCallback) {
params.client_secret = yield provider.clientSecretCallback(provider.clientSecret);
} else {
params.client_secret = provider.clientSecret;
}
}Steps to reproduce
Use custom oauth2 config:
{
id: "signicat",
name: "Signicat BankID",
type: "oauth",
version: "2.0",
scope: "openid profile signicat.national_id signicat.certificate",
params: { grant_type: "authorization_code" },
accessTokenUrl: `https://${config.signicatHost}/oidc/token`,
requestTokenUrl: `https://${config.signicatHost}/oidc/token`,
authorizationUrl: `https://${config.signicatHost}/oidc/authorize?response_type=code&response_mode=form_post&acr_values=urn:signicat:oidc:method:sbid`,
profileUrl: `https://${config.signicatHost}/oidc/userinfo`,
clientId: config.signicatClientId,
clientSecret: config.signicatClientSecret,
idToken: true,
state: false,
clientSecretCallback: () => null, // Remove client_secret from post data in request
headers: {
Authorization: `Basic ${Buffer.from(config.signicatClientId + ":" + config.signicatClientSecret, "ascii").toString("base64")}`,
}
}Expected behavior
client_secret should be omitted from postData if headers.Authorization.includes("Basic")
Feedback
Documentation refers to searching through online documentation, code comments and issue history. The example project refers to next-auth-example.
Describe the bug
We're trying to integrate Signicat OpenID with Basic auth and get this message:
This is because
client_secretis sent as post data here, even if itsnullorundefined:next-auth/src/server/lib/oauth/callback.js
Line 225 in 9dbd372
With empty client secret (note the:
&client_secret=):Here are some possible solutions:
params.client_secretat all.Steps to reproduce
Use custom oauth2 config:
Expected behavior
client_secretshould be omitted from postData ifheaders.Authorization.includes("Basic")Feedback
Documentation refers to searching through online documentation, code comments and issue history. The example project refers to next-auth-example.