Supporting basic authentication Token exchange in both the OAuth2 and OIDC handlers
Open
affected-very-few
area-auth
enhancement
severity-minor
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 290
Description
https://github.com/aspnet/AspNetCore/pull/9448#issuecomment-484298711
OAuth and OIDC have a standard flow of sending the clientid and secret to the token endpoint using a custom basic auth format. 4 of the auth handlers in aspnet-contrib require this flow and have to implement it manually. We expect many other providers also support this format since it's the one required in the spec.
Note the encoding is customized in the OAuth spec. (I don't think the FitBit handler is following that).
https://github.com/aspnet-contrib/AspNet.Security.OAuth.Providers/blob/aad5420654c65b5fb9908ddf298dbab17076338c/src/AspNet.Security.OAuth.Fitbit/FitbitAuthenticationHandler.cs#L66-L70
@PinpointTownes
Contributor guide
Assessment
This issue has not been assessed yet.