#3691·harness

Drone CI - refresh token grant should use user ID of OAuth client user instead of repo owner

Author: ecmchowCreated May 23, 2026Updated Sep 15, 2026

Gitea v1.26.2 fixed a security issue which added additional checking on the OAuth refresh token https://github.com/go-gitea/gitea/pull/37704

This exposed the incorrect implementation of Drone CI cron job token refresh function:

  1. Gitea OAuth application client ID/secret created under User A for Drone CI to connect to Gitea
  2. Repo created under User B which User A is added as collaborator
  3. Set a cron job in Drone CI on the repo

When the cron job triggered, Drone CI send a POST request to /login/oauth/access_token with following payload

  • The Client ID/secret in Basic Auth header (which belongs to User A)
  • grant_type=refresh_token&refresh_token=XXX where the JWT token grant is generated with User B
json
{
  "gnt": <the-repo-owner-user-B>,
  "tt": 1,
  "exp": 1782151221,
  "iat": 1779523221
}

Since the gnt grant user ID does not match the creator of OAuth application, Gitea now responds an 400 error `refresh token belongs to a different client.

Drone CI should generate refresh token using OAuth application creator user ID instead of repo owner user ID

Relevant code in Drone CI:

Issue created in Gitea: https://github.com/go-gitea/gitea/issues/37807