OIDC callback (first sign-in) #16

New issue

Closed

opened 2026-09-14 17:04:57 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-09-14 17:04:57 +00:00

Owner

Parent

#11 — Spec: The flow-serving bridge (gRPC ext_authz Check + OIDC/Exchange flows + callback/logout listener)

What to build

The OIDC callback — the first sign-in completing: the IdP redirects the browser back to the App's registered callbackURL (on :8082); the Bridge verifies it, trades the code for tokens, establishes the Session, and returns the user to the page they were trying to reach.

Acceptance criteria

Validates the state param against the state/nonce cookie (CSRF); a mismatch (a forged callback) is rejected.
Resolves the App from the state cookie's appKey (no reliance on the gateway forwarding the Host to :8082).
Exchanges the code via the authorization_code grant using the client secret (asserted on the token-endpoint double's received form).
Sets the plain Session cookie (id_token + refresh_token) and 302s the browser to returnTo.
returnTo comes from the plain state cookie (not the state URL param), so the return URL is not logged by the IdP or leaked in the redirect.

Blocked by

#14 — OIDC steady-state Check

## Parent #11 — Spec: The flow-serving bridge (gRPC ext_authz Check + OIDC/Exchange flows + callback/logout listener) ## What to build The OIDC callback — the first sign-in completing: the IdP redirects the browser back to the App's registered `callbackURL` (on `:8082`); the Bridge verifies it, trades the `code` for tokens, establishes the Session, and returns the user to the page they were trying to reach. ## Acceptance criteria - [ ] Validates the `state` param against the `state`/nonce cookie (CSRF); a mismatch (a forged callback) is rejected. - [ ] Resolves the App from the `state` cookie's `appKey` (no reliance on the gateway forwarding the Host to `:8082`). - [ ] Exchanges the `code` via the `authorization_code` grant using the client secret (asserted on the token-endpoint double's received form). - [ ] Sets the plain Session cookie (id_token + refresh_token) and 302s the browser to `returnTo`. - [ ] `returnTo` comes from the plain `state` cookie (not the `state` URL param), so the return URL is not logged by the IdP or leaked in the redirect. ## Blocked by - #14 — OIDC steady-state Check

ginjiruu added this to the Flow-serving bridge (spec #11) milestone

2026-09-14 17:05:34 +00:00

~~ginjiruu referenced this issue 2026-09-14 17:05:35 +00:00~~

Logout (clear cookie + RP-initiated) #19

ginjiruu added the

ready-for-agent

label

2026-09-14 17:08:11 +00:00

ginjiruu referenced this issue from a pull request that will close it,

2026-09-15 04:55:17 +00:00

OIDC callback (first sign-in completion: state/nonce validation, code exchange, session cookie) #25

ginjiruu closed this issue