PKCE support for SSO #2806
Open
PKCE support for SSO #2806
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
avdb13
requested review from
dessalines,
SleeplessOne1917 and
matc-pub
as code owners
avdb13
force-pushed
the
pkce
branch
5 times, most recently
from
5de4ba2 to
949b2b8
Compare
privacyguard
suggested changes
Nov 13, 2024
src/shared/utils/helpers/oauth.ts
Outdated
| .replace(/=+$/, ""); | ||
| } | ||
|
|
||
| export async function generatePKCE(): Promise<[string, string]> { |
There was a problem hiding this comment.
Why not simply use base64url encoding on 96 random bytes instead of trying to use the whole PKCE_ALPHABET?
src/shared/components/home/login.tsx
Outdated
| @@ -126,22 +127,30 @@ export async function handleUseOAuthProvider(params: { | |||
| const redirectUri = `${window.location.origin}/oauth/callback`; | |||
|
|
|||
| const state = crypto.randomUUID(); | |||
| const [code_challenge, code_verifier] = await generatePKCE(); | |||
There was a problem hiding this comment.
We should probably only generatePKCE if params.oauth_provider?.use_pkce is true
avdb13
force-pushed
the
pkce
branch
2 times, most recently
from
d5c9f6c to
c4bb7f6
Compare
avdb13
force-pushed
the
pkce
branch
3 times, most recently
from
863ada6 to
f1cafbf
Compare
|
Woodpecker failure due to |
|
@avdb13 Okay I've deployed a version you can test: |
dessalines
approved these changes
Nov 27, 2024
|
Backend and is-client PRs are merged: |
|
Will take a closer look at this sometime this week. |
dessalines
approved these changes
Feb 11, 2025
SleeplessOne1917
approved these changes
Feb 14, 2025
dessalines
approved these changes
Feb 18, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
In continuation of LemmyNet/lemmy#4881.
Implements PKCE support, in order to mitigate against the threat of authorization code interception attacks.
Background reading: https://www.oauth.com/oauth2-servers/pkce