Daniel Bankmann b11d991d1e fix(oauth): pass resolved redirect_uri to token exchange (#1019) ...

When --redirect-url is omitted, the local callback listener binds to a
free port and opts.RedirectURL is rewritten with it. oauth2Config.RedirectURL
was never updated, so Exchange() sent the stale http://127.0.0.1:0 while
the authorize step had sent the real port. RFC-6749-compliant servers
(Gitea >= #37704, current Forgejo) reject the mismatch.

Propagate the resolved URL back into oauth2Config before Exchange. Add a
regression test using httptest that drives the flow end-to-end and asserts
the redirect_uri values match.

---------

Co-authored-by: dbankmann <204984+dbankmann@users.noreply.gitea.com>
Reviewed-on: https://gitea.com/gitea/tea/pulls/1019
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: Daniel Bankmann <204984+dbankmann@noreply.gitea.com>
Co-committed-by: Daniel Bankmann <204984+dbankmann@noreply.gitea.com>

2026-06-20 20:03:34 +00:00

..

oauth_test.go

fix(oauth): pass resolved redirect_uri to token exchange (#1019)

2026-06-20 20:03:34 +00:00

oauth.go

fix(oauth): pass resolved redirect_uri to token exchange (#1019)

2026-06-20 20:03:34 +00:00