fix: omit client_secret in refresh token grant when client has no secret

[Pratham-Mishra04]

Summary

Public OAuth2 clients (e.g. those registered via dynamic registration against servers that only support token_endpoint_auth_method: none) have no client secret. During token refresh, unconditionally setting client_secret= in the POST body sends an empty client_secret_post authentication attempt. Strict authorization servers respond with invalid_client, which causes the token row to be flipped to needs_reauth even though the refresh token itself is valid.

Changes

• exchangeRefreshToken now only includes client_secret in the token endpoint request when the secret is non-empty, matching the existing behavior of exchangeCodeForTokensWithPKCE.
• Added TestRefresh_ClientSecretOnlySentWhenConfigured to assert that public clients (nil/empty secret) omit the client_secret parameter entirely, while confidential clients continue to send their secret.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

go test ./framework/oauth2/... -run TestRefresh_ClientSecretOnlySentWhenConfigured -v

Expected: both sub-tests pass — the public client case confirms client_secret is absent from the request, and the confidential client case confirms the secret is present with the correct value.

Breaking changes

• Yes
• No

Related issues

Security considerations

This change ensures that no empty client_secret is leaked in token endpoint requests for public clients. Confidential clients are unaffected and continue to send their secret as before.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Pratham-Mishra04]

• fix: omit client_secret in refresh token grant when client has no secret #7042 👈 (View in Graphite)
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: ae76f553-7839-4a43-b3e3-028b4954bfa0

📥 Commits

Reviewing files that changed from the base of the PR and between ba430a2 and 3fcb44b.

📒 Files selected for processing (2)

• framework/oauth2/main.go
• framework/oauth2/refresh_client_secret_test.go

Included review availability: 6 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 10 reviews per hour.

---

📝 Summary

Summary by CodeRabbit

• Bug Fixes
  • OAuth2 refresh-token requests no longer send an empty client secret for public clients.
  • Configured client secrets continue to be sent unchanged for confidential clients.
  • Public clients can now successfully refresh access tokens without providing unnecessary credentials.
  • Refresh-token exchanges continue to use the correct OAuth2 grant flow and return refreshed access tokens.

Walkthrough

The refresh-token exchange now sends client_secret only when configured. HTTP-backed tests cover public and confidential clients, request parameters, grant type, and refreshed token handling.

Changes

OAuth2 refresh-token authentication

Layer / File(s)	Summary
Conditional client secret handling framework/oauth2/main.go, framework/oauth2/refresh_client_secret_test.go	Refresh-token requests omit an empty client_secret. Tests verify omission for public clients, transmission of configured secrets for confidential clients, the refresh_token grant, and the refreshed access token.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 3fcb4

The refresh-token change supports public OAuth clients without changing confidential-client authentication behavior. No unresolved merge-blocking issue is identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: omitting client_secret for refresh-token requests when no secret is configured.
Description check	✅ Passed	The description is mostly complete. It explains the problem, changes, affected area, test command, expected results, breaking-change status, security impact, and added tests. Some checklist items and …

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 09-09-fix_oauth2_omit_client_secret_from_refresh_token_requests_for_public_clients

---

_{Comment @coderabbitai help to get the list of available commands.}

The base branch was changed.

[Pratham-Mishra04]

@coderabbitai full-review

[coderabbitai]

@Pratham-Mishra04 I will perform a full review of PR #7042.

✅ Action performed

Full review finished.

[akshaydeo]

Merge activity

• Sep 14, 10:37 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Sep 14, 10:37 AM UTC: @akshaydeo merged this pull request with Graphite.