[server][auth] add OIDC PKCE support #13

gbw commented 2025年07月09日 07:20:04 +02:00

also supported by google oidc -- code_challenge_methods_supported per https://accounts.google.com/.well-known/openid-configuration

also supported by google oidc -- `code_challenge_methods_supported` per https://accounts.google.com/.well-known/openid-configuration

shroff commented 2025年07月09日 08:13:55 +02:00

Great work! Definitely nice to support more secure standards.

What would happen if a provider doesn't support this challenge method? Is it the client's responsibility to ensure support or is it backwards compatible by default? My guess is the former but I'm not sure.

Great work! Definitely nice to support more secure standards. What would happen if a provider doesn't support this challenge method? Is it the client's responsibility to ensure support or is it backwards compatible by default? My guess is the former but I'm not sure.

gbw commented 2025年07月09日 08:59:11 +02:00

if the IDP followed rfc 6749, then "The authorization server MUST ignore unrecognized request parameters." however there's no guarantees that every IDP does so.
i did a quick check of some IDPs listed here and almost all of them do support pkce. i can see three potential options:

1. accept it as is
2. check the well-known endpoint for capabilities (specifically look for code_challenge_methods_supported and S256)
3. add a config variable for it

if the IDP followed rfc 6749, then "The authorization server MUST ignore unrecognized request parameters." however there's no guarantees that every IDP does so. i did a quick check of some IDPs listed [here](https://github.com/lastlogin-net/obligator?tab=readme-ov-file#comparison-is-the-thief-of-joy) and almost all of them do support pkce. i can see three potential options: 1. accept it as is 2. check the well-known endpoint for capabilities (specifically look for code_challenge_methods_supported and S256) 3. add a config variable for it

shroff commented 2025年07月09日 10:27:11 +02:00

I was thinking more along the lines of 2, but I think it's more work than it's worth at this point

I was thinking more along the lines of 2, but I think it's more work than it's worth at this point

shroff commented 2025年07月09日 10:27:12 +02:00

I was thinking more along the lines of 2, but I think it's more work than it's worth at this point

I was thinking more along the lines of 2, but I think it's more work than it's worth at this point