From 9d2bb0d1250d8d73eeb9c85530ee7b3db3bb2db9 Mon Sep 17 00:00:00 2001
From: Ireneusz Kawalec <ikawalec@secureauth.com>
Date: Thu, 10 Sep 2026 08:47:54 +0200
Subject: [PATCH] fix: send client_id on the token request when no auth method
 is set

Fixes #160
---
 internal/oauth2/request.go      |  2 +-
 internal/oauth2/request_test.go | 48 +++++++++++++++++++++++++++++++++
 2 files changed, 49 insertions(+), 1 deletion(-)

diff --git a/internal/oauth2/request.go b/internal/oauth2/request.go
index dbd52ae..f96ad2c 100644
--- a/internal/oauth2/request.go
+++ b/internal/oauth2/request.go
@@ -197,7 +197,7 @@ func (r *Request) AuthenticateClient(
 	var err error
 
 	switch cconfig.AuthMethod {
-	case NoneAuthMethod:
+	case NoneAuthMethod, "":
 		r.Form.Set("client_id", cconfig.ClientID)
 	case ClientSecretPostAuthMethod:
 		r.Form.Set("client_id", cconfig.ClientID)
diff --git a/internal/oauth2/request_test.go b/internal/oauth2/request_test.go
index caf1d3d..ce7775f 100644
--- a/internal/oauth2/request_test.go
+++ b/internal/oauth2/request_test.go
@@ -100,3 +100,51 @@ func TestRequestTokenResource(t *testing.T) {
 		})
 	}
 }
+
+func TestRequestTokenClientID(t *testing.T) {
+	tests := map[string]struct {
+		authMethod string
+		expected   string
+	}{
+		"unset":              {authMethod: "", expected: "test-client"},
+		"none":               {authMethod: oauth2.NoneAuthMethod, expected: "test-client"},
+		"client_secret_post": {authMethod: oauth2.ClientSecretPostAuthMethod, expected: "test-client"},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			var got url.Values
+
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				body, err := io.ReadAll(r.Body)
+				require.NoError(t, err)
+
+				got, err = url.ParseQuery(string(body))
+				require.NoError(t, err)
+
+				w.Header().Set("Content-Type", "application/json")
+				_, _ = w.Write([]byte(`{"access_token":"tok","token_type":"Bearer","expires_in":3600}`))
+			}))
+			defer srv.Close()
+
+			cconfig := oauth2.ClientConfig{
+				ClientID:   "test-client",
+				GrantType:  oauth2.DeviceGrantType,
+				AuthMethod: tc.authMethod,
+			}
+			sconfig := oauth2.ServerConfig{TokenEndpoint: srv.URL}
+
+			_, _, err := oauth2.RequestToken(
+				context.Background(),
+				cconfig,
+				sconfig,
+				&http.Client{},
+				oauth2.WithDeviceCode("device-code"),
+			)
+			require.NoError(t, err)
+
+			require.Equal(t, tc.expected, got.Get("client_id"))
+			require.Equal(t, "device-code", got.Get("device_code"))
+		})
+	}
+}