Follow-up from the #691 audit (LOW, interop-only). The oauth2 upstream auth sends client credentials as form body parameters (client_secret_post). RFC 6749 §2.3.1 prefers HTTP Basic (client_secret_basic) and says body params SHOULD be limited to clients unable to use Basic; some identity providers accept only Basic. Add a way to select the client-authentication method (or try Basic first and fall back), so those IdPs work. Same trust surface either way — the same host receives the secret.
Follow-up from the #691 audit (LOW, interop-only). The oauth2 upstream auth sends client credentials as form body parameters (client_secret_post). RFC 6749 §2.3.1 prefers HTTP Basic (client_secret_basic) and says body params SHOULD be limited to clients unable to use Basic; some identity providers accept only Basic. Add a way to select the client-authentication method (or try Basic first and fall back), so those IdPs work. Same trust surface either way — the same host receives the secret.