Skip to content

v0.1.20

Choose a tag to compare

View all tags
@rustyconover rustyconover released this 06 Mar 03:50
· 106 commits to main since this release
v0.1.20
d703eb1

What's Changed

  • Add client_secret to OAuth Resource Metadata (OAuthResourceMetadata, OAuthResourceMetadataResponse, WWW-Authenticate header)
  • Add parse_client_secret() helper for extracting client_secret from WWW-Authenticate headers
  • Reduce .well-known/oauth-protected-resource cache max-age from 3600s to 60s

Google requires client_secret in OAuth resource metadata even when using PKCE. The client_secret follows the same pattern as client_id — it appears in the well-known JSON document, the WWW-Authenticate challenge header, and is discoverable via http_oauth_metadata().

Assets 2
Loading