postmanlabs / postman-app-support

Postman is an API platform for building and using APIs. Postman simplifies each step of the API lifecycle and streamlines collaboration so you can create better APIs—faster.
https://www.postman.com
5.85k stars 841 forks source link

Token Refresh button always sends client credentials in Authorization Header when it should send in body as well #13245

Open jonje opened 2 weeks ago

jonje commented 2 weeks ago

Is there an existing issue for this?

Describe the Issue

Clicking the refresh button should send the refresh_token request client_id and secret in the body when Client Authentication is set to "Send client credentials in body" instead of always being in the Authorization header.

Steps To Reproduce

  1. Go to your IDP and create a new client with Auth Method client_secret_post and enable refresh tokens
  2. Open new request tab
  3. Select Authorization tab
  4. Select Auth Type of OAuth 2.0
  5. Fill out Configure New Token form with Authorization Code flow
  6. Select Client Authentication to be "Send client credentials in body"
  7. Click on "Get New Access Token"
  8. Click on "Use Token"
  9. Scroll up to where the token is listed
  10. Click on the "Refresh" button
  11. You should now get an error pop up
  12. Click on console and you should see an error stating "Error: invalid_client, Description: Invalid authentication method for accessing this endpoint."
  13. Expand the POST request in the console
  14. Look at Request Headers and you will see Authorization header with Basic encoded credentials

Screenshots or Videos

Screenshot 2024-11-06 at 7 40 42 AM Screenshot 2024-11-06 at 7 40 58 AM Screenshot 2024-11-06 at 8 07 21 AM Screenshot 2024-11-06 at 7 42 29 AM Screenshot 2024-11-06 at 7 43 17 AM

Operating System

macOS

Postman Version

11.18

Postman Platform

Postman App

User Account Type

Signed In User

Additional Context?

No response