openclaw - 💡(How to fix) Fix Bug: OAuth token exchange silently proceeds without client_secret + hardcoded redirect port [1 participants]

1. Throw error or log warning when clientSecret is missing (if confidential client mode is intended)

Fix Plan

To address the OAuth-related issues, we will implement the following fixes:

• Enforce Client Secret: Modify the code to throw an error or log a warning when clientSecret is missing.
• Dynamic Redirect Port: Make the redirect port configurable via an environment variable or use a dynamic port.

Step-by-Step Solution

Enforce Client Secret

if (!clientSecret) {
  throw new Error("Client secret is required for confidential client mode");
}
body.set("client_secret", clientSecret);

Dynamic Redirect Port

const redirectPort = process.env.OAUTH_REDIRECT_PORT || 8085;
const redirectUri = `http://localhost:${redirectPort}/oauth2callback`;

Alternatively, use a dynamic port with server.listen(0):

const server = app.listen(0, () => {
  const port = server.address().port;
  const redirectUri = `http://localhost:${port}/oauth2callback`;
  // ...
});

Verification

To verify the fixes, test the OAuth flow with and without a client secret set. Additionally, test the redirect port configuration by setting the OAUTH_REDIRECT_PORT environment variable to a different value.

Extra Tips

• Consider logging a warning or throwing an error when the client secret is missing to prevent accidental downgrades to public client mode.
• Use environment variables to configure sensitive values like client secrets and redirect ports.
• Implement additional security measures, such as validating the redirect URI and handling errors during the OAuth flow.