Download Latest Version v5.9.7 source code.zip (369.4 kB) Google Add to Preferred Sources
Home / v5.9.6
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2026-08-11 696 Bytes
v5.9.6 source code.tar.gz 2026-08-11 207.2 kB
v5.9.6 source code.zip 2026-08-11 363.8 kB
Totals: 3 Items   571.6 kB 1
  • Reject requests that present more than one client identity (e.g. an Authorization: Basic header for one client and a client_id parameter naming another) with an invalid_request error, instead of authenticating the first extracted identity and silently discarding the other one. A client_id sent alongside another authentication method keeps working when it identifies the same client (RFC 7521 §4.2). Like the RFC 6749 §2.3 check released in 5.9.5, this validation does not apply when client_credentials is configured with a callable extractor, since the credentials the remaining extractors would return are never evaluated — the client_credentials option documents that now.
Source: README.md, updated 2026-08-11