{"record":{"id":"464c6635e44fff24","repo":"phacility/phabricator","slug":"request-included-a-client-id-parameter-and-an-aut","errorCode":null,"errorMessage":"Request included a client_id parameter and an \"Authorization\" header with a username, but the values \"%s\" and \"%s\") disagree. The values must match.","messagePattern":"Request included a client_id parameter and an \"Authorization\" header with a username, but the values \"(.+?)\" and \"(.+?)\"\\) disagree\\. The values must match\\.","errorType":"http","errorClass":"Exception","httpStatus":500,"severity":"error","filePath":"src/applications/oauthserver/controller/PhabricatorOAuthServerTokenController.php","lineNumber":28,"sourceCode":"  public function shouldAllowRestrictedParameter($parameter_name) {\n    if ($parameter_name == 'code') {\n      return true;\n    }\n    return parent::shouldAllowRestrictedParameter($parameter_name);\n  }\n\n  public function handleRequest(AphrontRequest $request) {\n    $grant_type = $request->getStr('grant_type');\n    $code = $request->getStr('code');\n    $redirect_uri = $request->getStr('redirect_uri');\n    $response = new PhabricatorOAuthResponse();\n    $server = new PhabricatorOAuthServer();\n\n    $client_id_parameter = $request->getStr('client_id');\n    $client_id_header = idx($_SERVER, 'PHP_AUTH_USER');\n    if (strlen($client_id_parameter) && strlen($client_id_header)) {\n      if ($client_id_parameter !== $client_id_header) {\n        throw new Exception(\n          pht(\n            'Request included a client_id parameter and an \"Authorization\" '.\n            'header with a username, but the values \"%s\" and \"%s\") disagree. '.\n            'The values must match.',\n            $client_id_parameter,\n            $client_id_header));\n      }\n    }\n\n    $client_secret_parameter = $request->getStr('client_secret');\n    $client_secret_header = idx($_SERVER, 'PHP_AUTH_PW');\n    if (strlen($client_secret_parameter)) {\n      // If the `client_secret` parameter is present, prefer parameters.\n      $client_phid = $client_id_parameter;\n      $client_secret = $client_secret_parameter;\n    } else {\n      // Otherwise, read values from the \"Authorization\" header.\n      $client_phid = $client_id_header;","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/oauthserver/controller/PhabricatorOAuthServerTokenController.php#L10-L46","documentation":"Error \"Request included a client_id parameter and an \"Authorization\" header with a username, but the values \"%s\" and \"%s\") disagree. The values must match.\" thrown in phacility/phabricator.","triggerScenarios":"Thrown at src/applications/oauthserver/controller/PhabricatorOAuthServerTokenController.php:28 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}