Skip to content

🐛 Bug: OAuth login fails when instance configuration values have trailing whitespace #8737

@rucoder

Description

@rucoder

Description

When configuring OAuth credentials (e.g. GitHub Client ID) through the God Mode admin UI, any leading/trailing whitespace in the pasted value is persisted to the database as-is. This causes the OAuth redirect URL to include a URL-encoded space (%20) in the client_id parameter, which makes the identity provider return a 404.

This is easy to trigger — simply copy-pasting a Client ID from a web page often picks up a trailing space.

Steps to reproduce

  1. Self-host Plane v1.2.3 (also present on preview branch)
  2. Go to God Mode → Authentication → GitHub → Configure
  3. Paste a GitHub OAuth Client ID with a trailing space (e.g. Ov23li2Dep2t79q18nxD )
  4. Save and enable GitHub SSO
  5. Click "Login with GitHub" on the login page
  6. The redirect URL contains client_id=Ov23li2Dep2t79q18nxD%20
  7. GitHub returns a 404

Expected behavior

Configuration values should be stripped of leading/trailing whitespace before being persisted to the database.

Actual behavior

Whitespace is saved verbatim, breaking OAuth flows and potentially any other credential that is sensitive to extra characters.

Root cause

InstanceConfigurationEndpoint.patch() in apps/api/plane/license/api/views/configuration.py saves the raw value from request.data without calling .strip():

value = request.data.get(configuration.key, configuration.value)

Affected

All OAuth providers (GitHub, Google, GitLab, Gitea) and likely any credential field saved via the instance configuration endpoint.

Environment

  • Plane version: v1.2.3 (also present on current preview branch)
  • Deployment: Self-hosted Docker Compose

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions