Skip to content

Fix Microsoft OAuth token exchange returning invalid HTML/404 - #429

Merged
techjewel merged 2 commits into
masterfrom
ibrahim-microsoft-oauth-invalid-html-404
Sep 16, 2026
Merged

techjewel merged 2 commits into
masterfrom
ibrahim-microsoft-oauth-invalid-html-404

Conversation

@aftabshuvo

Copy link
Copy Markdown
Member

Summary

  • Some hosting environments negotiate ALPN/TLS in a way that causes Microsoft's OAuth token endpoint (login.microsoftonline.com/.../oauth2/v2.0/token) to respond with an HTML error page (404) instead of the expected JSON, breaking Outlook connection setup and token refresh.
  • Adds MicrosoftTokenTransport, a narrowly-scoped http_api_curl hook that disables CURLOPT_SSL_ENABLE_ALPN only for requests matching Microsoft's token host + path — no other provider's requests (Gmail, SMTP, Microsoft Graph, etc.) are touched.
  • OAuth2Provider now registers this hook before the token request and additionally forces httpversion: 1.1 on the same request, both aimed at avoiding the connection negotiation that triggers the bad response.

Test plan

  • Added integration test coverage in tests/integration/connection-behavior.php:
    • Confirms the Outlook token request is sent with httpversion: 1.1.
    • Confirms MicrosoftTokenTransport::isMicrosoftTokenUrl() matches only the Microsoft token endpoint (not the authorize endpoint, not Graph, not Google's token URL).
    • Confirms disableAlpnForMicrosoftTokenRequest() only disables ALPN for the Microsoft token URL and is a no-op for everything else.
  • Manually verify against an environment that previously reproduced the HTML/404 error: connect an Outlook/Microsoft account and confirm the token exchange now returns JSON and the connection succeeds. (Not verified live in this session — recommend confirming before merge.)

aftabshuvo and others added 2 commits September 16, 2026 22:34
Force HTTP/1.1 and disable ALPN specifically for
login.microsoftonline.com token requests, since some server
environments negotiate a connection that Microsoft's token endpoint
rejects with an HTML error page instead of the expected JSON.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
PHPStan level 0 rejected the bool-returning action callback. Keep the
bool worker for direct test coverage and register a void wrapper as the
action. Regenerate the composer classmap instead of hand-editing it,
which also picks up the Documentation and SecretMasker entries master
was missing.
@techjewel
techjewel merged commit 78c462c into master Sep 16, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants