From f0493a7ba83c2bc1aee16637113b1884dcd7da76 Mon Sep 17 00:00:00 2001 From: Michel-Marie MAUDET Date: Thu, 6 Aug 2026 19:01:38 +0200 Subject: [PATCH] fix(oauth): Use unauthorized_client for unregistered grant types The token endpoint already refused grant types the client had not registered, but reported it as `invalid_grant`. RFC 6749 section 5.2 reserves `invalid_grant` for an authorization grant which is "invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client", and defines `unauthorized_client` for a client which "is not authorized to use this authorization grant type". Report the condition with the error code the specification assigns to it, matching the device authorization endpoint. --- changelog.d/2110.bugfix.md | 2 +- src/service/oauth/mod.rs | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/changelog.d/2110.bugfix.md b/changelog.d/2110.bugfix.md index 030d55ab0..6ea4c6c6d 100644 --- a/changelog.d/2110.bugfix.md +++ b/changelog.d/2110.bugfix.md @@ -1 +1 @@ -The OAuth 2.0 device authorization endpoint now rejects clients which did not register the device code grant type, instead of issuing them a device code. Contributed by @mmaudet. +The OAuth 2.0 device authorization endpoint now rejects clients which did not register the device code grant type, instead of issuing them a device code. The token endpoint now returns the `unauthorized_client` error code when a client requests a grant type it did not register, instead of `invalid_grant`. Contributed by @mmaudet. diff --git a/src/service/oauth/mod.rs b/src/service/oauth/mod.rs index 114b1edec..e0aa3a9d0 100644 --- a/src/service/oauth/mod.rs +++ b/src/service/oauth/mod.rs @@ -442,7 +442,7 @@ pub async fn issue_token(&self, request: TokenRequest) -> Result