Skip to content

Commit b77f3b0

Browse files
🚀 Niklas Arensclaude
andcommitted
fix: remove incorrect URL encoding from OAuth2 Basic auth credentials
OAuth2 Basic authentication was incorrectly URL-encoding client credentials before Base64 encoding. This caused characters like '>' and '?' to become '%3e' and '%3f' respectively, breaking authentication. According to RFC 7617 (HTTP Basic Authentication) and RFC 6749 (OAuth 2.0) Section 2.3.1, Basic auth credentials should be: 1. Concatenated as "client_id:client_secret" 2. Base64 encoded directly (no URL encoding first) 3. Sent as "Authorization: Basic <base64>" URL encoding is for URL parameters, not Basic auth credentials. This fixes authentication with OAuth2 providers that strictly validate Basic auth header format, especially when client secrets contain special characters that would be URL-encoded incorrectly. Co-Authored-By: Claude (claude-sonnet-4) <noreply@anthropic.com>
1 parent 29d9ab5 commit b77f3b0

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

lua/kulala/cmd/oauth.lua

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,7 @@ local function add_client_credentials(config_id, body, headers)
185185
if not validate_auth_params(config_id, required_params) then return body, headers end
186186

187187
if type == "basic" then
188-
local id, secret = vim.uri_encode(config["Client ID"]), vim.uri_encode(config["Client Secret"])
188+
local id, secret = config["Client ID"], config["Client Secret"]
189189
table.insert(headers, "Authorization: Basic " .. Crypto.base64_encode_standard(id .. ":" .. secret))
190190
end
191191

0 commit comments

Comments
 (0)