Use basic auth for Authelia token exchange

src/internal/adapters/authelia/adapter_test.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"strings"
 	"testing"
 
@@ -179,6 +180,27 @@ func TestHandleCallback_Success_PreferredUsername(t *testing.T) {
 			if req.Method != http.MethodPost {
 				t.Errorf("expected POST, got %s", req.Method)
 			}
+			gotID, gotSecret, ok := req.BasicAuth()
+			if !ok {
+				t.Error("expected client_secret_basic authentication")
+			}
+			if gotID != "keycape" || gotSecret != "test-secret" {
+				t.Errorf("unexpected basic auth credentials for client %q", gotID)
+			}
+			rawBody, err := io.ReadAll(req.Body)
+			if err != nil {
+				t.Fatalf("read request body: %v", err)
+			}
+			form, err := url.ParseQuery(string(rawBody))
+			if err != nil {
+				t.Fatalf("parse request body: %v", err)
+			}
+			if form.Get("client_secret") != "" {
+				t.Error("client_secret must not be sent in the form body")
+			}
+			if form.Get("client_id") != "keycape" {
+				t.Errorf("client_id: want keycape, got %q", form.Get("client_id"))
+			}
 			return jsonResponse(tokenBody), nil
 		},
 	}