[X] I've searched existing issues and found nothing related to my issue.
Describe the bug
When requesting an OAuth 2.0Client Credentials token on an Access Token URL which requires mTLS, the Client Certificates added to the collection are not used.
The UI displays ✅ Request made successfully, even when the response is not a valid token response. In our case, it's a HTML page containing a Cloudflare error.
Writing a POST request using the client_id, client_secret, grant_type and scope in the body (Content-Typeapplication/x-www-form-urlencoded) and providing Basic authorization in the Authorization header however, does take these Client Certificates into account. This then results in succesful retrieval of a token.
.bru file to reproduce the bug
This .bru file demonstrates the request to succesfully retrieve a token through a POST request.
client_secret has been obfuscated
I have checked the following:
Describe the bug
When requesting an
OAuth 2.0
Client Credentials
token on an Access Token URL which requires mTLS, the Client Certificates added to the collection are not used.The UI displays
✅ Request made successfully
, even when the response is not a valid token response. In our case, it's a HTML page containing a Cloudflare error.Writing a POST request using the
client_id
,client_secret
,grant_type
andscope
in the body (Content-Type
application/x-www-form-urlencoded
) and providing Basic authorization in theAuthorization
header however, does take these Client Certificates into account. This then results in succesful retrieval of a token..bru file to reproduce the bug
This .bru file demonstrates the request to succesfully retrieve a token through a POST request.
client_secret
has been obfuscatedScreenshots/Live demo link
Client Credentials setup
Result of Get Access Token from https://auth.test-datakluis.shared.topicuszorg.nl/oauth2/token: