From 9e32fd5464ae9f5f29a15c405d61275e667d2ea1 Mon Sep 17 00:00:00 2001
From: Allen Zhou <46854522+allenzhou101@users.noreply.github.com>
Date: Mon, 24 Feb 2025 16:55:36 -0800
Subject: [PATCH] Only send client secret and code verifier  if defined

---
 src/server/auth/proxyProvider.ts | 33 +++++++++++++++++++++++---------
 1 file changed, 24 insertions(+), 9 deletions(-)

diff --git a/src/server/auth/proxyProvider.ts b/src/server/auth/proxyProvider.ts
index 3771fb2f..f85ef853 100644
--- a/src/server/auth/proxyProvider.ts
+++ b/src/server/auth/proxyProvider.ts
@@ -66,7 +66,9 @@ export class ProxyOAuthServerProvider implements OAuthServerProvider {
         const params = new URLSearchParams();
         params.set("token", request.token);
         params.set("client_id", client.client_id);
-        params.set("client_secret", client.client_secret || "");
+        if (client.client_secret) {
+          params.set("client_secret", client.client_secret);
+        }
         if (request.token_type_hint) {
           params.set("token_type_hint", request.token_type_hint);
         }
@@ -158,20 +160,30 @@ export class ProxyOAuthServerProvider implements OAuthServerProvider {
     if (!tokenUrl) {
       throw new Error("No token endpoint configured");
     }
+
+    const params = new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: client.client_id,
+      code: authorizationCode,
+    });
+
+    if (client.client_secret) {
+      params.append("client_secret", client.client_secret);
+    }
+
+    if (codeVerifier) {
+      params.append("code_verifier", codeVerifier);
+    }
+
     const response = await fetch(tokenUrl, {
       method: "POST",
       headers: {
         "Content-Type": "application/x-www-form-urlencoded",
       },
-      body: new URLSearchParams({
-        grant_type: "authorization_code",
-        client_id: client.client_id,
-        client_secret: client.client_secret || "",
-        code: authorizationCode,
-        code_verifier: codeVerifier || "",
-      }),
+      body: params.toString(),
     });
 
+
     if (!response.ok) {
       throw new ServerError(`Token exchange failed: ${response.status}`);
     }
@@ -194,10 +206,13 @@ export class ProxyOAuthServerProvider implements OAuthServerProvider {
     const params = new URLSearchParams({
       grant_type: "refresh_token",
       client_id: client.client_id,
-      client_secret: client.client_secret || "",
       refresh_token: refreshToken,
     });
 
+    if (client.client_secret) {
+      params.set("client_secret", client.client_secret);
+    }
+
     if (scopes?.length) {
       params.set("scope", scopes.join(" "));
     }