fix(client): don't send client_id in token body under client_secret_basic#3159
Draft
SpiliosDimakopoulos wants to merge 1 commit into
Draft
Conversation
…asic RFC 6749 §2.3: with HTTP Basic auth, client credentials must not also appear in the request body. prepare_token_auth() already stripped client_secret for client_secret_basic but left client_id in, so strict token endpoints (Keycloak, Okta strict mode) saw two authentication methods in one request and rejected it. Strip client_id too. Two existing tests asserted the old behavior explicitly (client_id present in the body) -- updated them to assert its absence instead. Fixes modelcontextprotocol#3138
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3138
What
Under
token_endpoint_auth_method = client_secret_basic, the OAuth client sendscredentials via
Authorization: Basic ...— butprepare_token_auth()onlystripped
client_secretfrom the request body, leavingclient_idin. RFC 6749§2.3 requires that with Basic auth, client credentials not also appear in the
body. Strict token endpoints (Keycloak, Okta in strict mode) reject this as two
authentication methods in a single request.
Fix
One-line change: strip
client_idalongsideclient_secretfrom the body whenauth_method == "client_secret_basic".Testing
Two existing tests in
tests/client/test_auth.pyexplicitly asserted the old(buggy) behavior —
assert "client_id=test%40client" in content # client_id still in body. Updated both to assert its absence instead, and added the samecheck to the refresh-token test for symmetry.
uv run pytest tests/client/,uv run ruff check .,uv run ruff format --check .,uv run pyrightall pass.Disclosure
I used AI (Claude) to help draft this fix; I've reviewed and understand the
change and I'm happy to answer questions about it.