Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

oauthutil: clear client secret if client ID is set #7809

Merged
merged 1 commit into from
May 11, 2024
Merged

oauthutil: clear client secret if client ID is set #7809

merged 1 commit into from
May 11, 2024

Commits on Apr 28, 2024

  1. oauthutil: clear client secret if client ID is set 

    When an external OAuth flow is being used (i.e. a client ID and an
OAuth token are set in the config), a client secret should not be set.
If one is, the server may reject a token refresh attempt.

But there's no way to clear out a backend's default client secret via
configuration, since empty-string config values are ignored.

So instead, when a client ID is set, we should clear out any default
client secret, since it wouldn't apply anyway.
    @mikix
    mikix committed Apr 28, 2024
    Configuration menu
    Copy the full SHA
    325b9d9 View commit details
    Browse the repository at this point in the history