Skip to content

Consider erroring when client authentication method is basic #12585

Open
@jzheaux

Description

@jzheaux

Questions like https://stackoverflow.com/questions/75224023/spring-oauth2-login-not-working-after-migrating-to-spring-boot-3 indicate that it's not clear that clientAuthenticationMethod: basic is no longer a supported value for ClientAuthenticationMethod.

We should consider erroring and telling applications to change basic to client_secret_basic and post to client_secret_post.

(Note: this could also be done in Spring Boot possibly, though I think we should first consider doing it in Spring Security since we can catch more misconfigurations that way)

Related to https://docs.spring.io/spring-security/reference/5.8/migration/servlet/oauth2.html#_clientauthenticationmethod

Metadata

Metadata

Assignees

No one assigned

    Labels

    in: configAn issue in spring-security-configtype: bugA general bug

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions