PKCE (always) + id_token nonce validation + public-client no-secret #41

Merged

ginjiruu merged 2 commits from t36-pkce-nonce into t34-oidc-trio

2026-09-16 00:51:21 +00:00

ginjiruu commented

2026-09-16 00:38:38 +00:00

Owner

Closes #36

Make the OIDC Flow always use PKCE (both Public and Confidential clients), validate the id_token nonce against the State blob's nonce, and make Public clients send no client_secret on the code-exchange and refresh grants (Confidential clients still send it).

PKCE via x/oauth2 (GenerateVerifier / S256ChallengeOption / VerifierOption); the State blob carries the pkce_verifier.
The callback verifies the exchanged id_token (go-oidc) and 403s on a nonce mismatch or verification failure (fail-closed, no Session).
Public clients set Config.ClientSecret=""; x/oauth2 omits an empty client_secret from the form entirely (verified, not just empty).
Includes code-review fixes: DRY clientSecretOf/sessionTTL helpers and a log-style cleanup.

Stacked on #34 (which stacks on #33 and #32). Part of the public-client + trio effort (spec #31).

Closes #36 Make the OIDC Flow **always use PKCE** (both Public and Confidential clients), validate the id_token **nonce** against the State blob's nonce, and make **Public clients send no `client_secret`** on the code-exchange and refresh grants (Confidential clients still send it). - PKCE via x/oauth2 (`GenerateVerifier` / `S256ChallengeOption` / `VerifierOption`); the State blob carries the `pkce_verifier`. - The callback verifies the exchanged id_token (go-oidc) and 403s on a nonce mismatch or verification failure (fail-closed, no Session). - Public clients set `Config.ClientSecret=""`; x/oauth2 omits an empty `client_secret` from the form entirely (verified, not just empty). - Includes code-review fixes: DRY `clientSecretOf`/`sessionTTL` helpers and a log-style cleanup. Stacked on #34 (which stacks on #33 and #32). Part of the public-client + trio effort (spec #31).

ginjiruu added 2 commits

2026-09-16 00:38:38 +00:00

feat: always-PKCE + id_token nonce validation + public-client no-secret (#36 ) b6fdcca054

refactor: address code-review feedback (DRY clientSecretOf/sessionTTL, log style)

Lint / Run on Ubuntu (push) Has been cancelled

Details

E2E Tests / Run on Ubuntu (push) Has been cancelled

Details

Tests / Run on Ubuntu (push) Has been cancelled

Details

Lint / Run on Ubuntu (pull_request) Has been cancelled

Details