Files
Gitea/tests
Shivansh Garg c0a8eb8e74 fix: OIDC discovery advertises unsupported id_token response_type (#39498)
The OIDC discovery document at `/.well-known/openid-configuration`
advertised `id_token` in `response_types_supported`, but
`/login/oauth/authorize` only implements the authorization code flow and
rejects any other response_type with `unsupported_response_type`. This
mismatch caused OIDC client libraries that rely on discovery to attempt
the implicit flow and fail silently.

This removes `id_token` from `response_types_supported` so discovery
matches actual server behavior, and adds an integration test asserting
`response_type=id_token` is rejected consistently.

Fixes #39482.
2026-10-08 18:10:54 +00:00
..