From 36b9acc97e0f142dab6430c91a71131790523cad Mon Sep 17 00:00:00 2001
From: Felix Weinberger <fweinberger@anthropic.com>
Date: Thu, 14 Aug 2025 17:03:12 +0100
Subject: [PATCH] fix: filter out client_secret when storing OAuth client
 information

---
 client/src/lib/auth.ts | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/client/src/lib/auth.ts b/client/src/lib/auth.ts
index 7012c782..1a3db326 100644
--- a/client/src/lib/auth.ts
+++ b/client/src/lib/auth.ts
@@ -110,10 +110,17 @@ export class InspectorOAuthClientProvider implements OAuthClientProvider {
   }
 
   saveClientInformation(clientInformation: OAuthClientInformation) {
+    // Remove client_secret before storing (not needed after initial OAuth flow)
+    const safeInfo = Object.fromEntries(
+      Object.entries(clientInformation).filter(
+        ([key]) => key !== "client_secret",
+      ),
+    ) as OAuthClientInformation;
+
     // Save the dynamically registered client information to session storage
     saveClientInformationToSessionStorage({
       serverUrl: this.serverUrl,
-      clientInformation,
+      clientInformation: safeInfo,
       isPreregistered: false,
     });
   }