Decode Basic Auth Credentials

[joshuarubin]

It looks like credentials, both client_id and client_secret, should be percent encoded before combining and base64 encoding them for basic authentication according to https://tools.ietf.org/html/rfc6749#section-2.3.1

I have a few clients that don't work with hydra because they do percent encode but hydra doesn't decode.

[eliasgs]

I experienced this as well, but I don't see urlencoding the credentials mentioned in rfc2617#section-2 (even the example given is just base64 encoded). The formulation in rfc6749#section-2.3.1 seems ambiguous on this point, so in my opinion hydra does the right thing following rfc2617.

On the other hand it's an annoying detail that might have some pragmatic solution?

[aeneasr]

It's been addressed in PR #537 but as you might notice the CI fails sometimes due to golang/oauth2#237

[aeneasr]

This is now resolved, please be aware that golang.org/x/oauth2 does not send client id and secret using urlencoding, my patch for this is here: https://go-review.googlesource.com/c/46473/