From e009bacfcb01f843335c767d0975c7066efa0423 Mon Sep 17 00:00:00 2001
From: Nikola Petrov <nikola@poolside.ai>
Date: Fri, 12 Dec 2025 16:44:26 +0200
Subject: [PATCH] oauthex: fix content type check in getJSON (#721)

The content type header contains full mimetype string which might
contain parameters. The getJSON function doesn't account for this and so
some responses fail to parse although they are perfectly acceptable. For
example
```
curl -vv 'https://github.com/.well-known/oauth-authorization-server/login/oauth'
```
returns a content type header with the value
```
content-type: application/json; charset=utf-8
```
which is perfectly valid but fails in the current logic.
---
 oauthex/oauth2.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/oauthex/oauth2.go b/oauthex/oauth2.go
index f876be0..cdda695 100644
--- a/oauthex/oauth2.go
+++ b/oauthex/oauth2.go
@@ -13,6 +13,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"mime"
 	"net/http"
 	"net/url"
 	"strings"
@@ -57,7 +58,9 @@ func getJSON[T any](ctx context.Context, c *http.Client, url string, limit int64
 		return nil, fmt.Errorf("bad status %s", res.Status)
 	}
 	// Specs require application/json.
-	if ct := res.Header.Get("Content-Type"); ct != "application/json" {
+	ct := res.Header.Get("Content-Type")
+	mediaType, _, err := mime.ParseMediaType(ct)
+	if err != nil || mediaType != "application/json" {
 		return nil, fmt.Errorf("bad content type %q", ct)
 	}