Function selectClientAuthMethod

src/client/auth.ts:263–300

(clientInformation: OAuthClientInformationMixed, supportedMethods: string[])

 * @returns The selected authentication method
 */
export function selectClientAuthMethod(clientInformation: OAuthClientInformationMixed, supportedMethods: string[]): ClientAuthMethod {
    const hasClientSecret = clientInformation.client_secret !== undefined;

    // Prefer the method returned by the server during client registration, if valid.
    // When server metadata is present we also require the method to be listed as supported;
    // when supportedMethods is empty (metadata omitted the field) the DCR hint stands alone.
    if (
        'token_endpoint_auth_method' in clientInformation &&
        clientInformation.token_endpoint_auth_method &&
        isClientAuthMethod(clientInformation.token_endpoint_auth_method) &&
        (supportedMethods.length === 0 || supportedMethods.includes(clientInformation.token_endpoint_auth_method))
    ) {
        return clientInformation.token_endpoint_auth_method;
    }

    // If server metadata omits token_endpoint_auth_methods_supported, RFC 8414 §2 says the
    // default is client_secret_basic. RFC 6749 §2.3.1 also requires servers to support HTTP
    // Basic authentication for clients with a secret, making it the safest default.
    if (supportedMethods.length === 0) {
        return hasClientSecret ? 'client_secret_basic' : 'none';
    }

    // Try methods in priority order (most secure first)
    if (hasClientSecret && supportedMethods.includes('client_secret_basic')) {
        return 'client_secret_basic';
    }

    if (hasClientSecret && supportedMethods.includes('client_secret_post')) {
        return 'client_secret_post';
    }

    if (supportedMethods.includes('none')) {
        return 'none';
    }

    // Fallback: use what we have
    return hasClientSecret ? 'client_secret_post' : 'none';
}

/**
 * Applies client authentication to the request based on the specified method.