fix(endpoint-auth): validate client_id against local client.id

getindiekit · Aug 25, 2024 · ae9a209 · ae9a209
1 parent cab4fb1
commit ae9a209
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/packages/endpoint-auth/lib/middleware/code.js b/packages/endpoint-auth/lib/middleware/code.js
@@ -38,7 +38,7 @@ export const codeValidator = (request, response, next) => {
     }
 
     // Validate `client_id` against that provided in authorization request
-    if (getCanonicalUrl(client_id) !== getCanonicalUrl(client.url)) {
+    if (getCanonicalUrl(client_id) !== getCanonicalUrl(client.id)) {
       throw IndiekitError.unauthorized(
         response.locals.__("BadRequestError.invalidValue", "client_id"),
       );