PKCE (always) + id_token nonce + public-client no-secret #36

New issue

Closed

opened 2026-09-15 23:27:18 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-09-15 23:27:18 +00:00

Owner

Parent

#31 — Spec: public-client support + replace hand-rolled protocol code with the x/oauth2 + go-oidc + hstern trio

What to build

The OIDC Flow always uses PKCE (both Public and Confidential clients): the authorization URL carries the S256 code_challenge + code_challenge_method + nonce, the State blob carries the pkceVerifier, and the code exchange presents the matching code_verifier. The id_token nonce is validated against the State blob's nonce. Public clients send no client_secret on the code-exchange and refresh grants; Confidential clients still send it. A public-client App now signs in end-to-end.

Acceptance criteria

The authorization URL always carries code_challenge (S256) + code_challenge_method + nonce.
The State blob carries the pkceVerifier; the code exchange presents the matching code_verifier.
The id_token nonce is validated against the State blob's nonce (a mismatch rejects the session).
A Public client sends no client_secret on the code-exchange and refresh grants; a Confidential client still sends it.
A public-client App signs in end-to-end (serve test: 302 → IdP → callback → Session cookie → authorized Check).
make lint and make test pass.

Blocked by

#32 — Public-client config: optional clientSecretRef (CRD + registry)
#33 — Securecookie cookies + Cookie key (BYO + leader-generated)
#34 — OIDC Flow to the trio: x/oauth2 + go-oidc (mechanical swap)

## Parent #31 — Spec: public-client support + replace hand-rolled protocol code with the x/oauth2 + go-oidc + hstern trio ## What to build The **OIDC Flow always uses PKCE** (both Public and Confidential clients): the authorization URL carries the S256 `code_challenge` + `code_challenge_method` + `nonce`, the State blob carries the `pkceVerifier`, and the code exchange presents the matching `code_verifier`. The id_token **`nonce` is validated** against the State blob's nonce. **Public clients send no `client_secret`** on the code-exchange and refresh grants; Confidential clients still send it. A public-client App now signs in end-to-end. ## Acceptance criteria - [ ] The authorization URL always carries `code_challenge` (S256) + `code_challenge_method` + `nonce`. - [ ] The State blob carries the `pkceVerifier`; the code exchange presents the matching `code_verifier`. - [ ] The id_token `nonce` is validated against the State blob's nonce (a mismatch rejects the session). - [ ] A Public client sends no `client_secret` on the code-exchange and refresh grants; a Confidential client still sends it. - [ ] A public-client App signs in end-to-end (serve test: 302 → IdP → callback → Session cookie → authorized Check). - [ ] `make lint` and `make test` pass. ## Blocked by - #32 — Public-client config: optional clientSecretRef (CRD + registry) - #33 — Securecookie cookies + Cookie key (BYO + leader-generated) - #34 — OIDC Flow to the trio: x/oauth2 + go-oidc (mechanical swap)

ginjiruu referenced this issue

2026-09-15 23:27:28 +00:00

E2E: portable-cluster rip-and-replace re-run (OIDC + Exchange; #30 gateway gate) #37

ginjiruu added the

ready-for-agent

label

2026-09-15 23:27:36 +00:00

ginjiruu referenced this issue

2026-09-16 00:38:22 +00:00

Securecookie Session/State cookies + leader-authored Cookie key #39

ginjiruu referenced this issue

2026-09-16 00:38:30 +00:00