eclipse-ee4j / eclipse-ee4j/jersey
Missing support for OAuth2 client bearer type basic in access token request
Open
Component: security
evaluation-needed
oauth2
Priority: Major
secuirty
Type: Bug
- Dominant language
- Java
- Stars
- 730
- Forks
- 382
- PR merge metrics
- No merged PRs in 30d
Description
Some OAuth2 providers as per RFC 6749 4.1.3 require the header
Authorization: Basic [clientId:secret]
to be included as per RFC 6749 Section 4.1.1:
POST /token HTTP/1.1
Host: server.example.com
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
Content-Type: application/x-www-form-urlencoded
Can this be added to to the OAuth2ClientSupport.authorizationCodeGrantFlowBuilder ?
#### Affected Versions
[2.9.1]
Contributor guide
Assessment
This issue has not been assessed yet.