mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-24 03:54:00 +09:00
716295015b
Backport #39926 by @fixfon Fixes https://github.com/go-gitea/gitea/issues/39925 RFC 6749 §2.3.1 has clients form-urlencode the client id and secret before building the HTTP Basic header. `openid-client` with `client_secret_basic` does this and sends `-` as `%2D` and `_` as `%5F`. The token and introspection endpoints used the raw header values, so these clients failed with `invalid_client`. Both endpoints now decode the values with `url.QueryUnescape` before the client lookup, the secret check and the body consistency check, and reject a value that does not decode. Plain HTTP Basic parsing in `httpauth` is unchanged, since the encoding only applies to OAuth client authentication. Clients that don't encode are unaffected, since no client id or secret Gitea has ever issued contains `+` or `%`. Co-authored-by: fixfon <12512757+fixfon@users.noreply.github.com> Co-authored-by: silverwind <me@silverwind.io>