{"record":{"id":"2efac30966d581d1","repo":"siyuan-note/siyuan","slug":"github-oauth-client-secret-is-required","errorCode":null,"errorMessage":"GitHub OAuth client secret is required","messagePattern":"GitHub OAuth client secret is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/model/oidc.go","lineNumber":519,"sourceCode":"\tif !cancelOIDCValidation(input.PollToken, workspaceSession.OIDCBinding) {\n\t\tret.Code = -1\n\t\tret.Msg = oidcLanguage(369, \"Invalid OIDC configuration\")\n\t}\n}\n\nfunc validateOIDCConfiguration() error {\n\treturn ValidateOIDCConfiguration(Conf.GetOIDC())\n}\n\nfunc ValidateOIDCConfiguration(config *conf.OIDC) error {\n\tif config == nil || !config.Enabled {\n\t\treturn errors.New(\"OIDC login is not enabled\")\n\t}\n\tif config.ClientID == \"\" {\n\t\treturn errors.New(\"OIDC client ID is required\")\n\t}\n\tif config.Provider == conf.OIDCProviderGitHub && config.ClientSecret == \"\" {\n\t\treturn errors.New(\"GitHub OAuth client secret is required\")\n\t}\n\tif (config.Provider == conf.OIDCProviderCustom || config.Provider == conf.OIDCProviderMicrosoft) && config.IssuerURL == \"\" {\n\t\treturn errors.New(\"OIDC issuer URL is required\")\n\t}\n\tif (config.Provider == conf.OIDCProviderCustom || config.Provider == conf.OIDCProviderMicrosoft) && config.IssuerURL != \"\" {\n\t\tissuer, err := url.Parse(config.IssuerURL)\n\t\tif err != nil || issuer.Host == \"\" || issuer.User != nil || issuer.RawQuery != \"\" || issuer.Fragment != \"\" ||\n\t\t\t(issuer.Scheme != \"https\" && !util.IsLocalHostname(issuer.Hostname())) {\n\t\t\treturn errors.New(\"OIDC issuer URL must use HTTPS unless it is a loopback address\")\n\t\t}\n\t}\n\tif config.Provider != conf.OIDCProviderCustom && config.Provider != conf.OIDCProviderGoogle &&\n\t\tconfig.Provider != conf.OIDCProviderMicrosoft && config.Provider != conf.OIDCProviderGitHub {\n\t\treturn errors.New(\"Unsupported OIDC provider\")\n\t}\n\tif !config.AllowAll && len(config.ClaimRules) == 0 {\n\t\treturn errors.New(\"OIDC login requires at least one claim rule when Allow all users is disabled\")\n\t}","sourceCodeStart":501,"sourceCodeEnd":537,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/model/oidc.go#L501-L537","documentation":"Third check in ValidateOIDCConfiguration (kernel/model/oidc.go:519): provider is GitHub and ClientSecret is empty. GitHub OAuth (used as an OIDC stand-in here) mandates a server-side client secret, unlike PKCE-only flows; an empty secret is rejected before issuer validation.","triggerScenarios":"Choosing the GitHub provider and saving without pasting the GitHub OAuth App's Client Secret, or losing the secret during a config migration.","commonSituations":"Admin pasted only the Client ID from the GitHub OAuth App settings; CI deployed a config template that omits the secret.","solutions":["Open the GitHub OAuth App settings, generate/copy the Client Secret, and save it into the OIDC config alongside the Client ID.","Use a fresh secret if the old one may have leaked — GitHub secrets are not retrievable, only regeneratable.","Re-validate with ValidateOIDCProviderConfiguration after saving."],"exampleFix":"// before\ncfg := &conf.OIDC{Enabled: true, Provider: conf.OIDCProviderGitHub, ClientID: \"iv1.x\"}\n// after\ncfg := &conf.OIDC{Enabled: true, Provider: conf.OIDCProviderGitHub,\n    ClientID: \"iv1.x\", ClientSecret: os.Getenv(\"GITHUB_OAUTH_SECRET\")}","handlingStrategy":"validation","validationCode":"if cfg.Provider == conf.OIDCProviderGitHub && cfg.ClientSecret == \"\" {\n    return errors.New(\"GitHub OAuth secret required\")\n}\nreturn ValidateOIDCConfiguration(cfg)","typeGuard":"func githubSecretSet(c *conf.OIDC) bool {\n    return c.Provider != conf.OIDCProviderGitHub || c.ClientSecret != \"\"\n}","tryCatchPattern":null,"preventionTips":["Generate the GitHub secret at config time and store it in a secrets manager.","Rotate the secret on personnel changes; GitHub does not show it again after creation."],"tags":["oidc","github","oauth","config","secrets"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}