New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add ability to use non-escaped header auth style #476

Open

mwielbut wants to merge 1 commit into golang:master from openly-engineering:no-escape-auth-style

+52 −3

mwielbut commented Feb 12, 2021

Some OAuth providers do not adhere to the standard of accepting query escaped credentials when using Basic header auth. If your client ID or client secret contains non-standard URL query characters they will be rejected by the OAuth provider.
The current implementation always query escapes the client_id and client_secret:
req.SetBasicAuth(url.QueryEscape(clientID), url.QueryEscape(clientSecret))
This PR proposes a new AuthStyle AuthStyleInHeaderNoEscape that will pass the credentials unescaped.
This has been raised several times:
#251
#318
#320
but without this feature this library cannot be used against some key OAuth providers.

This PR replaces #351 which was raised in an early version of the code.


          Add ability to specify a non-escaped header auth

04dcc31

google-cla bot added the cla: yes label

mwielbut mentioned this pull request

Allow for option to bypass query escaping the auth header credentials #351

Closed

Contributor

gopherbot commented Feb 12, 2021

This PR (HEAD: 04dcc31) has been imported to Gerrit for code review.

Please visit https://go-review.googlesource.com/c/oauth2/+/291529 to see it.

Tip: You can toggle comments from me using the comments slash command (e.g. /comments off)
See the Wiki page for more info

Contributor

gopherbot commented Feb 12, 2021

Message from Go Bot:

Patch Set 1:

Congratulations on opening your first change. Thank you for your contribution!

Next steps:
A maintainer will review your change and provide feedback. See
https://golang.org/doc/contribute.html#review for more info and tips to get your
patch through code review.

Most changes in the Go project go through a few rounds of revision. This can be
surprising to people new to the project. The careful, iterative review process
is our way of helping mentor contributors and ensuring that their contributions
have a lasting impact.

Please don’t reply on this GitHub thread. Visit golang.org/cl/291529.
After addressing review feedback, remember to publish your drafts!

Contributor

gopherbot commented May 4, 2021

Message from Matt Wielbut:

Patch Set 1:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/291529.
After addressing review feedback, remember to publish your drafts!

Contributor

gopherbot commented May 13, 2021

Message from Andrii Deinega:

Patch Set 1:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/291529.
After addressing review feedback, remember to publish your drafts!

Contributor

gopherbot commented May 13, 2021

Message from Andrii Deinega:

Patch Set 1:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/291529.
After addressing review feedback, remember to publish your drafts!

Contributor

gopherbot commented May 13, 2021

Message from Cody Oss:

Patch Set 1: Code-Review-1

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/291529.
After addressing review feedback, remember to publish your drafts!

wirtsi mentioned this pull request

Basic auth on oauth2 token endpoint sometime does not propagate basic auth header properly redpanda-data/connect#787

Open

Contributor

gopherbot commented Nov 8, 2021

Message from Andrii Deinega:

Patch Set 1:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/291529.
After addressing review feedback, remember to publish your drafts!

Contributor

gopherbot commented Nov 8, 2021

Message from Andrii Deinega:

Patch Set 1:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/291529.
After addressing review feedback, remember to publish your drafts!

Contributor

gopherbot commented Nov 8, 2021

Message from Cody Oss:

Patch Set 1: Code-Review-1

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/291529.
After addressing review feedback, remember to publish your drafts!

glopezjc approved these changes

View reviewed changes

sfroment commented Jun 13, 2023

Is it planned to merge this at one point ?

tpihl commented Jun 15, 2023

They grew tired of saying no, so they said yes and then just no doing it. I am honestly less than impressed (i gave opinion more than a year ago in the source repo)

bachmanity1 mentioned this pull request

internal: optionally skip urlencoding client id and secret in header #708

Closed

MakotoE commented Feb 5, 2025

Thank you for posting this issue 4 years ago. I encountered this when I was trying to use this library with the go-oauth2/oauth2 library. I agree that this suggested feature will be very helpful and should fix my issue.

The relevant section of the RFC for Basic authentication scheme does not mention URL encoding at all.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels