Authorization Code Grant / Access Token Request: Sending a "client_id" and a basic auth header causes an INVALID_CLIENT error

[jlaci]

Describe the bug
The problem occurs in the Authorization Code Flow, when an authenticated client tries to exchange the auth code for an access token. If the client_id field in the request body is filled (along with the authorization header) it causes an INVALID_CLIENT error.

To Reproduce
Example client configuration:

		RegisteredClient frontendClient = RegisteredClient.withId("1138c5af-fd56-4a58-8c8f-769c2e327433")
				.clientId("my-awesome-client")
				.clientSecret("ca8831eb-e504-46f1-a514-8be84ba892ed")
				.clientAuthenticationMethod(ClientAuthenticationMethod.BASIC)
				.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
				.redirectUri("http://localhost:8080/swagger-ui/oauth2-redirect.html")
				.build();

Execute the flow normally:

1. Initiate the login
2. Submit the form
3. Exchange the auth code with a basic auth header of the client_id and secret and the request body containing the following parameters:

grant_type: authorization_code
code: the auth code
redirect_uri: http://localhost:8080/swagger-ui/oauth2-redirect.html
client_id: my-awesome-client

Expected behavior
The specification (https://tools.ietf.org/html/rfc6749#section-4.1.3) states that the field is only required if the client is not authenticated otherwise, but does not states that sending it anyways for authenticated clients should cause an error.

Some tools like springfox/swagger-ui sends the client_id anyways, which causes problems when integrating them.

[lizhongyue248]

Please see #120.

[vincent-hsin]

Please pull latest commit. It seems like has solved in commit ab09044.

[jgrandja]

@jlaci

If the client_id field in the request body is filled (along with the authorization header) it causes an INVALID_CLIENT error

This is the expected behaviour. If the client credentials are included in the Authorization header and the client_id is also included in the body then this is an invalid request. The client should not attempt to authenticate itself using multiple authentication schemes. Only one authentication scheme should be used, otherwise the request will be rejected.

As @vincent-hsin mentioned, the commit ab09044 will ignore the client_id parameter if the client is authenticating using HTTP Basic.