Basic Authorization Header is not correctly encoded in requests to OIDC servers

[Suchiman]

Q&A (please complete the following information)

• OS: Windows 10
• Browser: Edge
• Version: 102
• Method of installation: Swashbuckle (ASP.NET Core)
• Swagger-UI version: 4.10.3
• Swagger/OpenAPI version: OpenAPI 3.0.1

Content & configuration

    "securitySchemes": {
      "oidc": {
        "type": "openIdConnect",
        "openIdConnectUrl": "https://example.com/.well-known/openid-configuration"
      }
    }

Describe the bug you're encountering

When using a ClientId or ClientSecret that contains non ASCII characters, then a compliant OIDC server will reject the Authorization Header from swagger-ui due to the clientid / clientsecret not being application/x-www-form-urlencoded, trying to interpret the unicode characters as ASCII. https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1

To reproduce...

1. Open swagger
2. Authenticate via client_credentials using a ClientSecret that contains § for example.
3. OIDC server will respond with "invalid client credentials"

Expected behavior

If the OpenAPI specification states an openIdConnectUrl that specifies client_secret_basic, then the basic credentials should be application/x-www-form-urlencoded prior to base64 encoding. For OAuth2 servers, the most compatible option is probably the current behavior.

[hkosova]

Related (or duplicate): #5123