[Client] Support token_endpoint_auth_method: client_secret_basic, client_secret_post, none
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 55/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- php
- Domain
- authentication
Research direction
Start by reviewing the TokenEndpointAuthInterface scope and the work in dependencies #318 and #319, then trace how AS metadata exposes token_endpoint_auth_methods_supported. Use the auth/token-endpoint-auth-basic, auth/token-endpoint-auth-post, and auth/token-endpoint-auth-none conformance scenarios alongside unit tests; done means all three strategies are covered and the three baseline scenarios pass.
Written by the indexing model from the issue text.
Description
Context
Per RFC 6749 §2.3 (and AS metadata token_endpoint_auth_methods_supported), the client must send its credentials to the token endpoint using whichever method the AS advertises:
client_secret_basic→ HTTP BasicAuthorization: Basic base64(client_id:client_secret)client_secret_post→ form-encodedclient_id+client_secretbody paramsnone→ public client; onlyclient_idin body, no secret
Scope
- Strategy interface
TokenEndpointAuthInterface+ three implementations. - Auto-select implementation based on AS metadata's preferred method (intersect with what the client supports/has).
Conformance scenarios unblocked
auth/token-endpoint-auth-basic, auth/token-endpoint-auth-post, auth/token-endpoint-auth-none.
Dependencies
Blocked by: #318, #319.
Acceptance
- Unit tests per strategy.
- Conformance: 3 baseline scenarios pass.
cc @soyuka
- Dominant language
- PHP
- Stars
- 1.6k
- Forks
- 173
- Avg merge
- 2d 49m
- Merged PRs (30d)
- 23
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from modelcontextprotocol/php-sdk
-
[Server] Handler type uses bare Closure, hard to decorate RegistryInterface under strict PHPStan OpenServer
Difficulty 1/5 Under an hour Newbie friendliness 78/100
modelcontextprotocol/php-sdk#468 · 2 comments ·
-
needs confirmation needs maintainer action Server
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
modelcontextprotocol/php-sdk#398 · 1 reaction ·
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
modelcontextprotocol/php-sdk#370 ·
-
enhancement
Difficulty 4/5 3-5 days Newbie friendliness 55/100
modelcontextprotocol/php-sdk#510 · 1 comment ·
-
bug
Difficulty 4/5 3-5 days Newbie friendliness 45/100
modelcontextprotocol/php-sdk#504 ·
All issues in modelcontextprotocol/php-sdk
Similar issues
-
priority: p3
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
googleapis/librarian#7636 ·
-
0. Needs triage bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
nextcloud/fulltextsearch#1011 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
phpstan/phpstan-doctrine#794 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Automattic/static-site-importer#1767 ·