"fix: Remove urlencode from Basic Authentication header construction

According to RFC 2617 Section 2, Basic Authentication should use base64
encoding of the raw credentials without URL encoding. This change removes
the urlencode() calls that were incorrectly encoding the credentials
before base64 encoding.

This fixes issues with:
- Special characters in client_secret being double-encoded
- Non-compliance with RFC 2617 and RFC 7617
- Authentication failures with certain OpenID Connect providers

Author: ovsep

src/OpenIDConnectClient.php

@@ -841,7 +841,7 @@ public function requestResourceOwnerToken(bool $bClientAuth = false) {
         if($bClientAuth) {
             $token_endpoint_auth_methods_supported = $this->getProviderConfigValue('token_endpoint_auth_methods_supported', ['client_secret_basic']);
             if ($this->supportsAuthMethod('client_secret_basic', $token_endpoint_auth_methods_supported)) {
-                $headers = ['Authorization: Basic ' . base64_encode(urlencode($this->clientID) . ':' . urlencode($this->clientSecret))];
+                $headers = ['Authorization: Basic ' . base64_encode($this->clientID . ':' . $this->clientSecret)];
             } else {
                 $post_data['client_id']     = $this->clientID;
                 $post_data['client_secret'] = $this->clientSecret;
@@ -880,7 +880,7 @@ protected function requestTokens(string $code, array $headers = []) {
         $authorizationHeader = null;
         # Consider Basic authentication if provider config is set this way
         if ($this->supportsAuthMethod('client_secret_basic', $token_endpoint_auth_methods_supported)) {
-            $authorizationHeader = 'Authorization: Basic ' . base64_encode(urlencode($this->clientID) . ':' . urlencode($this->clientSecret));
+            $authorizationHeader = 'Authorization: Basic ' . base64_encode($this->clientID . ':' . $this->clientSecret);
             unset($token_params['client_secret'], $token_params['client_id']);
         }
 
@@ -962,7 +962,7 @@ public function requestTokenExchange(string $subjectToken, string $subjectTokenT
 
         # Consider Basic authentication if provider config is set this way
         if ($this->supportsAuthMethod('client_secret_basic', $token_endpoint_auth_methods_supported)) {
-            $headers = ['Authorization: Basic ' . base64_encode(urlencode($this->clientID) . ':' . urlencode($this->clientSecret))];
+            $headers = ['Authorization: Basic ' . base64_encode($this->clientID . ':' . $this->clientSecret)];
             unset($post_data['client_secret'], $post_data['client_id']);
         }
 
@@ -998,7 +998,7 @@ public function refreshToken(string $refresh_token) {
 
         # Consider Basic authentication if provider config is set this way
         if ($this->supportsAuthMethod('client_secret_basic', $token_endpoint_auth_methods_supported)) {
-            $headers = ['Authorization: Basic ' . base64_encode(urlencode($this->clientID) . ':' . urlencode($this->clientSecret))];
+            $headers = ['Authorization: Basic ' . base64_encode($this->clientID . ':' . $this->clientSecret)];
             unset($token_params['client_secret'], $token_params['client_id']);
         }
 
@@ -1644,7 +1644,7 @@ public function introspectToken(string $token, string $token_type_hint = '', ?st
         $clientSecret = $clientSecret ?? $this->clientSecret;
 
         // Convert token params to string format
-        $headers = ['Authorization: Basic ' . base64_encode(urlencode($clientId) . ':' . urlencode($clientSecret)),
+        $headers = ['Authorization: Basic ' . base64_encode($clientId . ':' . $clientSecret),
             'Accept: application/json'];
 
         if ($this->supportsAuthMethod('client_secret_jwt', $token_endpoint_auth_methods_supported)) {
@@ -1685,7 +1685,7 @@ public function revokeToken(string $token, string $token_type_hint = '', ?string
 
         // Convert token params to string format
         $post_params = http_build_query($post_data, '', '&');
-        $headers = ['Authorization: Basic ' . base64_encode(urlencode($clientId) . ':' . urlencode($clientSecret)),
+        $headers = ['Authorization: Basic ' . base64_encode($clientId . ':' . $clientSecret),
             'Accept: application/json'];
 
         return json_decode($this->fetchURL($revocation_endpoint, $post_params, $headers), false);