Fixed the 'client_id' validation – required for the Auth Code Flow only

AKlaus · Nov 4, 2024 · ba250da · ba250da
1 parent d6b3cba
commit ba250da
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/OpenIdDict.Server/Authorisation/OpenIdDictEvents.cs b/OpenIdDict.Server/Authorisation/OpenIdDictEvents.cs
@@ -50,7 +50,8 @@ internal static class OpenIdDictEvents
 	internal static Func<OpenIddictServerEvents.ValidateTokenRequestContext, ValueTask> ValidateTokenRequestFunc(AppSettings.AuthCredentialsSettings authSettings) => 
 		validateTokenRequestContext =>
 		{
-			if (!string.Equals(validateTokenRequestContext.ClientId, authSettings.ClientId, StringComparison.OrdinalIgnoreCase))
+			if (validateTokenRequestContext.Request.IsAuthorizationCodeFlow()	// Auth Code Flows must provide a predefined client_id 
+			    && !string.Equals(validateTokenRequestContext.ClientId, authSettings.ClientId, StringComparison.OrdinalIgnoreCase))
 			{
 				validateTokenRequestContext.Reject(
 					error: OpenIddictConstants.Errors.InvalidClient,