| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-08-11 | 696 Bytes | |
| v5.9.6 source code.tar.gz | 2026-08-11 | 207.2 kB | |
| v5.9.6 source code.zip | 2026-08-11 | 363.8 kB | |
| Totals: 3 Items | 571.6 kB | 1 | |
- Reject requests that present more than one client identity (e.g. an
Authorization: Basicheader for one client and aclient_idparameter naming another) with aninvalid_requesterror, instead of authenticating the first extracted identity and silently discarding the other one. Aclient_idsent alongside another authentication method keeps working when it identifies the same client (RFC 7521 §4.2). Like the RFC 6749 §2.3 check released in 5.9.5, this validation does not apply whenclient_credentialsis configured with a callable extractor, since the credentials the remaining extractors would return are never evaluated — theclient_credentialsoption documents that now.