如何解决TypeError: client_secret_basic客户端认证需client_secret错误

遇到认证错误：

"TypeError: client_secret_basic client authentication method requires a client_secret."

相关代码片段：

const express = require('express');
const session = require('express-session');
const { Issuer, generators } = require('openid-client');
const axios = require('axios');

const app = express();
const port = 3000;

app.use(session({
  secret: 'f06549ea-282a-4096-a3b4-d123bc881a00',
  resave: false,
  saveUninitialized: true,
}));

// Load environment variables
require('dotenv').config();

// OpenID Connect configuration
const azureTenantId = process.env.AZURE_TENANT_ID;
const clientId = process.env.CLIENT_ID;
const redirectUri = process.env.REDIRECT_URI;

const openIdConfigUrl = `https://login.microsoftonline.com/${azureTenantId}/v2.0/.well-known/openid-configuration`;

app.get('/auth/callback', async (req, res) => {
  try {
    const issuer = await Issuer.discover(openIdConfigUrl);
    const client = new issuer.Client({
      client_id: clientId,
      redirect_uris: [redirectUri],
    });

    if (!req.query.code) {
      // Generate and store PKCE code_verifier and code_challenge
      const codeVerifier = generators.codeVerifier();
      req.session.codeVerifier = codeVerifier;
      const codeChallenge = generators.codeChallenge(codeVerifier);

      // Initial authorization request with PKCE parameters
      const authorizationUrl = client.authorizationUrl({
        scope: 'openid',
        response_type: 'code',
        code_challenge: codeChallenge,
        code_challenge_method: 'S256',
        nonce: generators.nonce(),
      });

      res.redirect(authorizationUrl);
    } else {
      // Token exchange request with PKCE parameters
      const params = client.callbackParams(req);
      const tokenSet = await client.callback(redirectUri, params, {
        code_verifier: req.session.codeVerifier,
        response_type: 'code',
        token_endpoint_auth_method: 'none',
      });

      // Store the access token in the session or use it as needed
      const accessToken = tokenSet.access_token;
      console.log('Access token:', accessToken);

      // Call the API using the access token
      const apiUrl = 'https://api.example.com/data';
      const headers = {
        Authorization: `Bearer ${accessToken}`,
      };

      axios.get(apiUrl, { headers })
        .then(response => {
          // Process the API response and send it back to the client
          res.json(response.data);
        })
        .catch(error => {
          console.error('API request error:', error);
          res.status(500).send('API request error');
        });
    }
  } catch (error) {
    console.error('Authentication error:', error);
    res.status(500).send('Authentication error');
  }
});

app.listen(port, () => {
  console.log(`Server running on port ${port}`);
});

修复方案 #

错误核心原因是openid-client默认采用client_secret_basic认证方法，但代码未提供client_secret，且你在callback阶段指定的token_endpoint_auth_method: 'none'不生效——这个配置必须在创建Client实例时提前声明。

具体修复步骤 #

1. 创建issuer.Client实例时，明确添加token_endpoint_auth_method: 'none'，告诉客户端无需使用客户端密钥认证
2. 若你的应用是公共客户端类型，需确保Azure AD应用注册中"允许公共客户端流"已启用

修改后的完整代码 #

const express = require('express');
const session = require('express-session');
const { Issuer, generators } = require('openid-client');
const axios = require('axios');

const app = express();
const port = 3000;

app.use(session({
  secret: 'f06549ea-282a-4096-a3b4-d123bc881a00',
  resave: false,
  saveUninitialized: true,
}));

// Load environment variables
require('dotenv').config();

// OpenID Connect configuration
const azureTenantId = process.env.AZURE_TENANT_ID;
const clientId = process.env.CLIENT_ID;
const redirectUri = process.env.REDIRECT_URI;

const openIdConfigUrl = `https://login.microsoftonline.com/${azureTenantId}/v2.0/.well-known/openid-configuration`;

app.get('/auth/callback', async (req, res) => {
  try {
    const issuer = await Issuer.discover(openIdConfigUrl);
    // 关键：创建Client时指定认证方式为none，无需client_secret
    const client = new issuer.Client({
      client_id: clientId,
      redirect_uris: [redirectUri],
      token_endpoint_auth_method: 'none'
    });

    if (!req.query.code) {
      // Generate and store PKCE code_verifier and code_challenge
      const codeVerifier = generators.codeVerifier();
      req.session.codeVerifier = codeVerifier;
      const codeChallenge = generators.codeChallenge(codeVerifier);

      // Initial authorization request with PKCE parameters
      const authorizationUrl = client.authorizationUrl({
        scope: 'openid',
        response_type: 'code',
        code_challenge: codeChallenge,
        code_challenge_method: 'S256',
        nonce: generators.nonce(),
      });

      res.redirect(authorizationUrl);
    } else {
      // Token exchange request with PKCE parameters
      const params = client.callbackParams(req);
      const tokenSet = await client.callback(redirectUri, params, {
        code_verifier: req.session.codeVerifier,
        response_type: 'code'
      });

      // Store the access token in the session or use it as needed
      const accessToken = tokenSet.access_token;
      console.log('Access token:', accessToken);

      // Call the API using the access token
      const apiUrl = 'https://api.example.com/data';
      const headers = {
        Authorization: `Bearer ${accessToken}`,
      };

      axios.get(apiUrl, { headers })
        .then(response => {
          // Process the API response and send it back to the client
          res.json(response.data);
        })
        .catch(error => {
          console.error('API request error:', error);
          res.status(500).send('API request error');
        });
    }
  } catch (error) {
    console.error('Authentication error:', error);
    res.status(500).send('Authentication error');
  }
});

app.listen(port, () => {
  console.log(`Server running on port ${port}`);
});

补充说明 #

如果你的应用是机密客户端（比如后端服务），则不需要设置token_endpoint_auth_method: 'none'，而是在创建Client时添加client_secret: process.env.CLIENT_SECRET，同时确保Azure AD应用中已生成客户端密钥并配置到环境变量中。

内容的提问来源于stack exchange，提问作者sandip kakade