MCP oauth2 upstream auth: support client_secret_basic
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 157
- Forks
- 32
- Avg merge
- 1h 25m
- Merged PRs (30d)
- 145
Description
Follow-up from the #691 audit (LOW, interop-only). The oauth2 upstream auth sends client credentials as form body parameters (client_secret_post). RFC 6749 §2.3.1 prefers HTTP Basic (client_secret_basic) and says body params SHOULD be limited to clients unable to use Basic; some identity providers accept only Basic. Add a way to select the client-authentication method (or try Basic first and fall back), so those IdPs work. Same trust surface either way — the same host receives the secret.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test is named in the issue. Start by tracing the Rust implementation of OAuth2 upstream authentication and its token request, then review RFC 6749 §2.3.1. Done means client_secret_basic can be selected or used through the agreed fallback behavior, with coverage showing compatibility for identity providers that reject client_secret_post.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- api, authentication, backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100