| author |  clover caruso <git@paperclover.net> 2026-10-05 10:49:49-07:00 |
| committer | clover caruso <git@paperclover.net> 2026-10-05 15:36:02-07:00 |
| log | 036a0e63f8c0eaa73960243300cfd238c1553210 |
| tree | 2961bb6536cebd8c08a8cc67b2662095dc188769 |
| parent | 5c9d1a0136cdc91ef713ef1b029778da6f3f192d |
| signature | Signed by SSH key SHA256:52mNGHRsVFBDED9IAX5pe+LRWUefqTbxEReunq21QvU |
Send Astheno client credentials in the token request body
The live endpoint requires client_id and client_secret form fields despite advertising client_secret_basic. Share the same form credentials with GitHub and log only provider HTTP status and endpoint paths.
Assisted-by: gpt-61 files changed, 1 insertions(+), 3 deletions(-)
dashboard
src
dashboard/src/guest.rs+1-3
| ... | ... | @@ -249,14 +249,13 @@ async fn exchange( |
| 249 | 249 | ) -> Result<(String, String)> { |
| 250 | 250 | let form = [ |
| 251 | 251 | ("client_id", client), |
| 252 | ("client_secret", secret), | |
| 252 | 253 | ("grant_type", "authorization_code"), |
| 253 | 254 | ("code", code), |
| 254 | 255 | ("redirect_uri", callback), |
| 255 | 256 | ("code_verifier", string(&flow["verifier"])), |
| 256 | 257 | ]; |
| 257 | 258 | if provider == "github" { |
| 258 | let mut form = form.to_vec(); | |
| 259 | form.push(("client_secret", secret)); | |
| 260 | 259 | let token = json_bytes( |
| 261 | 260 | &response_bytes( |
| 262 | 261 | http.post("https://github.com/login/oauth/access_token") |
| ... | ... | @@ -309,7 +308,6 @@ async fn exchange( |
| 309 | 308 | let token = json_bytes( |
| 310 | 309 | &response_bytes( |
| 311 | 310 | http.post(format!("{ASTHENO}/api/token")) |
| 312 | .basic_auth(client, Some(secret)) | |
| 313 | 311 | .form(&form) |
| 314 | 312 | .send() |
| 315 | 313 | .await?, |