[PR #576] [CLOSED] If the client_secret is empty, don't post it at all. #676

New issue

Closed

opened 2026-03-03 17:29:36 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 17:29:36 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/OAuthSwift/OAuthSwift/pull/576
Author: @bobspryn
Created: 3/5/2020
Status: ❌ Closed

Base: master ← Head: master

📝 Commits (1)

8c982e6 If the client_secret is empty, don't post it at all.

📊 Changes

1 file changed (+12 additions, -4 deletions)

View changed files

📝 Sources/OAuth2Swift.swift (+12 -4)

📄 Description

Really we shouldn't be storing a client secret in an app at all, we should be using
PKCE. Some servers will reject the request if it's a "public" app and you include
the secret. Since it would be tricky to fully make it optional in the client everywhere,
I'm changing it to just ignore empty strings.

I didn't do this everywhere, as the other methods seem to assume the client/secret credentials are being used instead of pkce.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/OAuthSwift/OAuthSwift/pull/576 **Author:** [@bobspryn](https://github.com/bobspryn) **Created:** 3/5/2020 **Status:** ❌ Closed **Base:** `master` ← **Head:** `master` --- ### 📝 Commits (1) - [`8c982e6`](https://github.com/OAuthSwift/OAuthSwift/commit/8c982e6de3aab35de25669b322aca6c3957bf72d) If the client_secret is empty, don't post it at all. ### 📊 Changes **1 file changed** (+12 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `Sources/OAuth2Swift.swift` (+12 -4) </details> ### 📄 Description Really we [shouldn't be storing a client secret in an app at all](https://www.oauth.com/oauth2-servers/client-registration/client-id-secret/), we should be using PKCE. Some servers will reject the request if it's a "public" app and you include the secret. Since it would be tricky to fully make it optional in the client everywhere, I'm changing it to just ignore empty strings. I didn't do this everywhere, as the other methods seem to assume the client/secret credentials are being used instead of pkce. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>