fix(client): don't send client_id in token body under client_secret_basic

RFC 6749 section 2.3 requires that with HTTP Basic auth, client
credentials must not also appear in the request body. prepare_token_auth
stripped client_secret from the body for the client_secret_basic branch
but left client_id in, so strict token endpoints (Keycloak, Okta in
strict mode, and the RFC 6749 compliance test suite) reject the request
as presenting two authentication methods at once.

Fixes #3138

Two existing tests asserted the old behavior explicitly, updated both to
assert the corrected one, and added the same check to the refresh token
test for symmetry.

Signed-off-by: manjunathbhaskar <manjunathbhaskar854@gmail.com>

Author: manjunathbhaskar

src/mcp/client/auth/oauth2.py

@@ -207,8 +207,11 @@ def prepare_token_auth(
             credentials = f"{encoded_id}:{encoded_secret}"
             encoded_credentials = base64.b64encode(credentials.encode()).decode()
             headers["Authorization"] = f"Basic {encoded_credentials}"
-            # Don't include client_secret in body for basic auth
-            data = {k: v for k, v in data.items() if k != "client_secret"}
+            # RFC 6749 section 2.3: with HTTP Basic auth, client credentials must not also
+            # appear in the request body. Strict token endpoints reject a request that
+            # presents both the Authorization header and client_id in the body as two
+            # authentication methods at once.
+            data = {k: v for k, v in data.items() if k not in ("client_secret", "client_id")}
         elif auth_method == "client_secret_post" and self.client_info.client_id and self.client_info.client_secret:
             # Include client_id and client_secret in request body (RFC 6749 §2.3.1)
             data["client_id"] = self.client_info.client_id

tests/client/test_auth.py

@@ -680,7 +680,10 @@ async def test_basic_auth_token_exchange(self, oauth_provider: OAuthClientProvid
         # client_secret should NOT be in body for basic auth
         content = request.content.decode()
         assert "client_secret=" not in content
-        assert "client_id=test%40client" in content  # client_id still in body
+        # RFC 6749 section 2.3: with Basic auth, client_id must not appear in the body
+        # either, it is already presented via the Authorization header, and strict token
+        # endpoints reject a request that presents credentials both ways.
+        assert "client_id=" not in content
 
     @pytest.mark.anyio
     async def test_basic_auth_refresh_token(self, oauth_provider: OAuthClientProvider, valid_tokens: OAuthToken):
@@ -716,6 +719,9 @@ async def test_basic_auth_refresh_token(self, oauth_provider: OAuthClientProvide
         # client_secret should NOT be in body
         content = request.content.decode()
         assert "client_secret=" not in content
+        # ...and neither should client_id, for the same RFC 6749 section 2.3 reason as
+        # token exchange.
+        assert "client_id=" not in content
 
     @pytest.mark.anyio
     async def test_none_auth_method(self, oauth_provider: OAuthClientProvider):