pub fn client_metadata_http_client() -> ClientExpand description
The client OAuthState::default fetches client metadata documents with.
POST /oauth/par is unauthenticated, so the host this client talks to is
chosen by whoever called it. Two bounds are set here, at the client, as
well as per-request in client_metadata::resolve_client: a total deadline
of client_metadata::FETCH_TIMEOUT, and no redirect followed at all —
reqwest’s default is to follow up to ten, and a client metadata document
that arrives from anywhere but its own client_id is not that client’s
registration (see client_metadata::ClientMetadataError::Redirected).
Refusing here means the second request is never issued; the check in
resolve_client is what still holds if a deployment supplies its own
client.
Falls back to a default-configured client if the builder fails — the same
fallback crate::relay::RelayClient::new makes, for the same reason: a
startup path that refuses to construct is worse than a degraded one, and
resolve_client’s own bounds survive the fallback.