Skip to content

fix: add missing client_id in device authorization request #310

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jon4hz wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: add missing client_id in device authorization request #310

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions identity-model/src/IdentityModel/Client/HttpClientDeviceFlowExtensions.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ public static async Task<DeviceAuthorizationResponse> RequestDeviceAuthorization
var clone = request.Clone();

clone.Parameters.AddOptional(OidcConstants.AuthorizeRequest.Scope, request.Scope);
clone.Parameters.AddRequired(OidcConstants.AuthorizeRequest.ClientId, request.ClientId);
Copy link

Copilot AI Jan 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The client_id should only be added to parameters when ClientCredentialStyle is AuthorizationHeader. When ClientCredentialStyle is PostBody, the Prepare() method (called on line 27) already adds the client_id to the request body. Adding it unconditionally will cause the client_id to be duplicated in the request body when using PostBody authentication style.

The correct pattern (as seen in HttpClientPushedAuthorizationExtensions.cs lines 29-34) is:

// client id is always required, and will be added by the call to
// Prepare() for other client credential styles.
if (request.ClientCredentialStyle == ClientCredentialStyle.AuthorizationHeader)
{
    clone.Parameters.AddRequired(OidcConstants.AuthorizeRequest.ClientId, request.ClientId);
}

This ensures that:

  • When using AuthorizationHeader style: credentials go in the Authorization header, but client_id is still sent in the body (per RFC 8628)
  • When using PostBody style: Prepare() handles adding both client_id and client_secret to the body
Suggested change
clone.Parameters.AddRequired(OidcConstants.AuthorizeRequest.ClientId, request.ClientId);
// client id is always required, and will be added by the call to
// Prepare() for other client credential styles.
if (request.ClientCredentialStyle == ClientCredentialStyle.AuthorizationHeader)
{
clone.Parameters.AddRequired(OidcConstants.AuthorizeRequest.ClientId, request.ClientId);
}

Copilot uses AI. Check for mistakes.
Copy link
Author

@jon4hz jon4hz Jan 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like copilot is right and the client_id is set if I explicitly set the ClientCredentialStyle to PostBody.

In my opinion, setting the credential style shouldn't be necessary, though, since the device code authentication doesn't require any credentials.

How should I proceed here? I could see a:

if (request.ClientCredentialStyle != ClientCredentialStyle.PostBody) {
    clone.Parameters.AddRequired(OidcConstants.AuthorizeRequest.ClientId, request.ClientId);
}

What do you think?

clone.Method = HttpMethod.Post;
clone.Prepare();

Expand Down