mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-10 22:38:07 +00:00
The OIDC discovery document at `/.well-known/openid-configuration` advertised `id_token` in `response_types_supported`, but `/login/oauth/authorize` only implements the authorization code flow and rejects any other response_type with `unsupported_response_type`. This mismatch caused OIDC client libraries that rely on discovery to attempt the implicit flow and fail silently. This removes `id_token` from `response_types_supported` so discovery matches actual server behavior, and adds an integration test asserting `response_type=id_token` is rejected consistently. Fixes #39482.