{"record":{"id":"e019986bd78b5946","repo":"siyuan-note/siyuan","slug":"github-oauth-client-secret-is-required-e01998","errorCode":null,"errorMessage":"GitHub OAuth client secret is required","messagePattern":"GitHub OAuth client secret is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/model/oidc_provider/provider.go","lineNumber":46,"sourceCode":"\ntype Provider struct {\n\tkind         string\n\toauth2Config *oauth2.Config\n\tverifier     *oidc.IDTokenVerifier\n}\n\nfunc New(ctx context.Context, config *conf.OIDC, redirectURL string) (*Provider, error) {\n\tif config == nil {\n\t\treturn nil, errors.New(\"OIDC configuration is missing\")\n\t}\n\tif config.ClientID == \"\" {\n\t\treturn nil, errors.New(\"OIDC client ID is required\")\n\t}\n\tif redirectURL == \"\" {\n\t\treturn nil, errors.New(\"OIDC redirect URL is required\")\n\t}\n\tif config.Provider == conf.OIDCProviderGitHub && config.ClientSecret == \"\" {\n\t\treturn nil, errors.New(\"GitHub OAuth client secret is required\")\n\t}\n\tissuerURL := strings.TrimSpace(config.IssuerURL)\n\tswitch config.Provider {\n\tcase conf.OIDCProviderGoogle:\n\t\tissuerURL = googleIssuer\n\tcase conf.OIDCProviderMicrosoft:\n\t\t// Microsoft 多租户端点的 issuer 会随租户变化，必须使用租户专属 issuer。\n\tcase conf.OIDCProviderCustom:\n\tcase conf.OIDCProviderGitHub:\n\t\treturn newGitHub(config, redirectURL), nil\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported OIDC provider [%s]\", config.Provider)\n\t}\n\tif issuerURL == \"\" {\n\t\treturn nil, errors.New(\"OIDC issuer URL is required\")\n\t}\n\tdiscovered, err := oidc.NewProvider(ctx, issuerURL)\n\tif err != nil {","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/model/oidc_provider/provider.go#L28-L64","documentation":"Thrown by oidc_provider.New() when the provider is GitHub (conf.OIDCProviderGitHub) and config.ClientSecret is empty. GitHub's OAuth flow is the only provider in this constructor that requires a client secret upfront (others are validated later or use PKCE). The secret authenticates the server-to-server token exchange with GitHub.","triggerScenarios":"Calling New() with config.Provider == conf.OIDCProviderGitHub and an empty ClientSecret. All other providers skip this check, but GitHub's token endpoint requires the secret for the server-side exchange.","commonSituations":"The admin selected GitHub as the OIDC provider and entered the Client ID but forgot to paste the Client Secret from the GitHub OAuth App settings. The GitHub OAuth App was created as a new app (which always issues a secret) but it was not copied into SiYuan's config.","solutions":["Go to GitHub Settings - Developer settings - OAuth Apps, open the app, and copy the Client Secret into SiYuan's OIDC settings.","If the secret was lost, generate a new one in the GitHub OAuth App page and update SiYuan's config.","Validate the ClientSecret field in the API handler when provider is GitHub before calling New()."],"exampleFix":"// before\n// provider=GitHub but ClientSecret empty\nprovider, err := oidc_provider.New(ctx, config, redirectURL)\n\n// after\nif config.Provider == conf.OIDCProviderGitHub && config.ClientSecret == \"\" {\n    return nil, errors.New(\"GitHub OAuth client secret is required\")\n}\nprovider, err := oidc_provider.New(ctx, config, redirectURL)","handlingStrategy":"validation","validationCode":"if config.Provider == conf.OIDCProviderGitHub && config.ClientSecret == \"\" {\n    return nil, errors.New(\"GitHub OAuth client secret is required\")\n}\nprovider, err := oidc_provider.New(ctx, config, redirectURL)","typeGuard":"func hasGitHubSecret(c *conf.OIDC) bool {\n    if c.Provider != conf.OIDCProviderGitHub {\n        return true\n    }\n    return c.ClientSecret != \"\"\n}","tryCatchPattern":null,"preventionTips":["When selecting GitHub as provider, enforce ClientSecret as a required field in the settings form.","Copy the secret immediately after generating it in the GitHub OAuth App settings page."],"tags":["oidc","authentication","github","config","oauth2"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}