Injected Credentials with OAUTH2 Should Support BASIC Authentication
Open
area/oauth
enhancement
no stalebot
- Dominant language
- C++
- Stars
- 28.9k
- Forks
- 5.6k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 437
Description
*Title*: *Injected Credentials with OAUTH2 Should Support BASIC Authentication*
*Description*:
Currently, the OAUTH2 implementation of "injected credentials"[ only supports passing the Client ID and Client Secret as pararameters.](https://github.com/envoyproxy/envoy/blob/main/source/extensions/http/injected_credentials/oauth2/oauth_client.cc#L26-L28)
RFC 6749 mandates that BASIC auth should be supported. Although passing the ID's as paramers is supported, it's "[NOT RECOMMENDED](https://www.rfc-editor.org/rfc/rfc6749#section-2.3.1)" per the RFC.
`BASIC_AUTH` should be supported (and be the default)
[optional *Relevant Links*:]
https://www.rfc-editor.org/rfc/rfc6749#section-2.3.1
Contributor guide
Assessment
This issue has not been assessed yet.