Drone CI - refresh token grant should use user ID of OAuth client user instead of repo owner
Author: ecmchowCreated May 23, 2026Updated Sep 15, 2026
Gitea v1.26.2 fixed a security issue which added additional checking on the OAuth refresh token https://github.com/go-gitea/gitea/pull/37704
This exposed the incorrect implementation of Drone CI cron job token refresh function:
- Gitea OAuth application client ID/secret created under User A for Drone CI to connect to Gitea
- Repo created under User B which User A is added as collaborator
- Set a cron job in Drone CI on the repo
When the cron job triggered, Drone CI send a POST request to /login/oauth/access_token with following payload
- The Client ID/secret in Basic Auth header (which belongs to User A)
grant_type=refresh_token&refresh_token=XXXwhere the JWT token grant is generated with User B
{
"gnt": <the-repo-owner-user-B>,
"tt": 1,
"exp": 1782151221,
"iat": 1779523221
}Since the gnt grant user ID does not match the creator of OAuth application, Gitea now responds an 400 error `refresh token belongs to a different client.
Drone CI should generate refresh token using OAuth application creator user ID instead of repo owner user ID
Relevant code in Drone CI:
- https://github.com/harness/harness/blob/drone/trigger/cron/cron.go#L126-L153
- https://github.com/harness/harness/blob/drone/service/commit/commit.go#L72
Issue created in Gitea: https://github.com/go-gitea/gitea/issues/37807
Source: harness/harness