fix(oauth): token 兑换改用 HTTP Basic(client_secret_basic),修 401

Cloudflare OAuth 客户端默认 token_endpoint_auth_method = client_secret_basic,
只接受 Authorization: Basic 头。之前把 client_id/secret 放在 POST body
(client_secret_post),token 端点直接 401 invalid_client,描述里点名
"method 'client_secret_post' was requested" —— 表现为 Cloudflare 授权成功、
回调却报 token exchange failed: 401。

- exchangeToken 改 Basic 认证,凭据按 RFC 6749 §2.3.1 先 form-urlencoded 再 base64
- 失败时带回 Cloudflare 原始 error/error_description;invalid_client 额外提示
  「secret 只在创建时显示一次,轮换后旧值失效」
- cf-mock 复刻「只认 Basic」的行为,没有 Basic 头就返回 401(旧代码会被打回)
- 断言 token body 不含 client_id/client_secret,Basic 头解出正确凭据
- 88/88 测试

This commit is contained in:

bigcode

2026-09-30 17:16:14 +08:00

parent 2ce8a24707

commit 42c488050b

4 changed files with 115 additions and 8 deletions

									
										package.json
									
		+1
		-1
	
												View File
												
				@@ -1,6 +1,6 @@

				{

				  "name": "wmailhub",

				  "version": "2.3.4",

				  "version": "2.3.5",

				  "description": "WmailHub - 基于 Cloudflare Email Workers 的轻量邮件接收与转发平台(Console 直连 Email Worker)",

				  "private": true,

				  "type": "module",