Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Consider erroring when client authentication method is basic #12585

Open
jzheaux opened this issue Jan 25, 2023 · 0 comments
Open

Consider erroring when client authentication method is basic #12585

jzheaux opened this issue Jan 25, 2023 · 0 comments
Labels
in: config An issue in spring-security-config type: bug A general bug

Comments

@jzheaux
Copy link
Contributor

jzheaux commented Jan 25, 2023

Questions like https://stackoverflow.com/questions/75224023/spring-oauth2-login-not-working-after-migrating-to-spring-boot-3 indicate that it's not clear that clientAuthenticationMethod: basic is no longer a supported value for ClientAuthenticationMethod.

We should consider erroring and telling applications to change basic to client_secret_basic and post to client_secret_post.

(Note: this could also be done in Spring Boot possibly, though I think we should first consider doing it in Spring Security since we can catch more misconfigurations that way)

Related to https://docs.spring.io/spring-security/reference/5.8/migration/servlet/oauth2.html#_clientauthenticationmethod

@jzheaux jzheaux added status: waiting-for-triage An issue we've not yet triaged type: bug A general bug in: config An issue in spring-security-config and removed status: waiting-for-triage An issue we've not yet triaged labels Jan 25, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in: config An issue in spring-security-config type: bug A general bug
Projects
None yet
Development

No branches or pull requests

1 participant