OAuth2 Authorization Header mode sends credentials in both header and body
- Langage dominant
- Go
- Étoiles
- 1.2k
- Forks
- 69
- Métriques de merge des PR
- Aucune PR mergée en 30 j
Description
**Describe the bug**
When using OAuth2: Client Credentials with "Authorization Header" as the authentication method, it looks like Peekaping is sending the client ID and secret in both the Authorization header and the request body at the same time. This causes Authelia to reject the request because it sees two authentication methods in one request and considers it malformed.
**Database**
- sqlite
**To Reproduce**
Steps to reproduce the behavior:
1. Create a monitor with Authentication set to "OAuth2: Client Credentials"
2. Set Authentication Method to "Authorization Header"
3. Fill in Token URL, Client ID, Client Secret and Scope
4. Save and watch it fail against an Authelia token endpoint
**Expected behavior**
When "Authorization Header" is selected, credentials should only go in the header. Not in the body as well.
**Additional context**
Running Peekaping v0.0.46
Relevant authelia log:
```
time="2026-06-08T22:49:36Z" level=error msg="Access Request failed with error: The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Client Authentication failed with more than one known authentication method included in the request which is not permitted. The registered client with id 'peekaping' and the authorization server policy does not permit this malformed request. The `token_endpoint_auth_method` methods determined to be used were 'client_secret_basic', 'client_secret_post'." method=POST path=/api/oidc/token remote_ip=104.xx.xxx.xxx
```
Guide de contribution
Aucun guide de contribution indexé pour ce dépôt
Piste de recherche
Look for OAuth2 client credentials handling in the codebase, likely in a file related to HTTP client or authentication. The bug is sending credentials in both the Authorization header and request body. Find where the authentication method 'Authorization Header' is implemented and ensure it only sets the header, not the body. Test by creating a monitor with OAuth2 client credentials and checking the outgoing request.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- go
- Domaine
- api, authentication, backend
- Type d'issue
- Bug
- Difficulté
- 3/5
- Temps estimé
- 1-2 jours
- Activité
- Calme
- Clarté
- Clairement spécifiée
- Accessibilité débutants
- 65/100