Skip to content

Fix client secret basic - #685

Merged
H2CK merged 8 commits into
masterfrom
fix-client_secret_basic
Aug 19, 2026
Merged

Fix client secret basic#685
H2CK merged 8 commits into
masterfrom
fix-client_secret_basic

Conversation

@H2CK

@H2CK H2CK commented Aug 19, 2026

Copy link
Copy Markdown
Owner

Improved handling of client_secret_basic authentication. But still this must be implemented using a pseudo user backend since the Nextcloud Core intercepts any requests containing an Authorization header.

  • Improved pseudo user backend concerning integration with Nextcloud Core
  • Corrected urldecoding for clientId and clientSecrets
  • Allow to disable/enable client_secret_basic authentication in discovery endpoint using occ config:app:set oidc disable_auth_client_secret_basic --value true in case it should be disabled
  • client_secret_basic is automatically disabled at discovery endpoint when system value ´token_auth_enforced´ is enabled. Since in this case the pseudo user backend will not be called by the Nextcloud Core.

@H2CK H2CK linked an issue Aug 19, 2026 that may be closed by this pull request
@H2CK
H2CK merged commit f0110bc into master Aug 19, 2026
5 checks passed
@H2CK
H2CK deleted the fix-client_secret_basic branch August 19, 2026 09:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

client_secret_basic problems

1 participant