Repository navigation
Use PKCE for oauth2 logins - #327
Merged
Merged
Conversation
The oauth2 handler sent no PKCE parameters, which left logins without protection against authorization code injection and made servers that require PKCE reject them. RFC 9700 recommends PKCE for confidential clients too. Each login now generates a verifier, keeps it in the handshake token and sends its S256 challenge to the authorize endpoint; the callback sends the verifier to the token endpoint. Servers without PKCE support ignore both parameters. A handshake issued before this change carries no verifier, and its callback sends none.
Coverage Report for CI Build 42560394420Coverage increased (+0.09%) to 86.917%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
setup-go v7 is the current major, and golangci-lint v2.15.0 reports no new issues on either module. AGENTS.md drops its local lint instructions instead of tracking each pinned version and toolchain workaround.
paskal
force-pushed
the
feat/oauth2-pkce
branch
from
November 9, 2026 04:11
cf56f53 to
78edb0a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Previously, the oauth2 handler sent no PKCE parameters, so logins had no protection against authorization code injection, and servers that require PKCE rejected them. After this change, every login through the shared oauth2 handler, which serves the built-in oauth2 providers except Apple and every
AddCustomProviderregistration, generates a fresh verifier withoauth2.GenerateVerifier, keeps it in the handshake token asHandshake.CodeVerifier, and sends its S256 challenge to the authorize endpoint; the callback sends the verifier to the token endpoint. Servers without PKCE support ignore both parameters (RFC 7636 §5), so there is nothing to configure.A handshake issued before the upgrade carries no verifier, and its callback sends none, so logins in flight during a deploy still complete. The debug line in
LoginHandlerlogs the claims without the verifier. Apple uses its own handler and is unchanged. v1 and v2 get the same change.The mock oauth2 server in the provider tests now enforces PKCE, so every existing login test runs the full flow.
TestOauth2LoginSendsPKCEChallengecovers the S256 challenge, a fresh verifier per login and log redaction;TestOauth2CallbackWithoutPKCEVerifiercovers a handshake from before the change. Tests pass with-racefor both modules, and golangci-lint v2.12.2 reports no issues.The branch also bumps CI, in its own commit: both workflows move to
actions/setup-go@v7and golangci-lint v2.15.0, andAGENTS.mddrops its local lint instructions, which pinned the old version and a toolchain workaround. The other actions are already on their latest major. golangci-lint v2.15.0 reports no issues on either module, and actionlint passes on the workflows.Resolves #325