Enable PKCE Support #80
Conversation
| @@ -8,6 +8,7 @@ | |||
| # url: https://github.com/discourse/discourse-openid-connect | |||
|
|
|||
| enabled_site_setting :openid_connect_enabled | |||
| enabled_site_setting :openid_connect_use_pkce | |||
There was a problem hiding this comment.
enabled_site_setting means "when this site setting is disabled, turn off all plugin functionality". Each plugin can only have one. We definitely don't want the PKCE one here.
| enabled_site_setting :openid_connect_use_pkce |
| @@ -35,3 +35,6 @@ discourse_openid_connect: | |||
| textarea: true | |||
| openid_connect_match_by_email: | |||
| default: true | |||
| openid_connect_use_pkce: | |||
There was a problem hiding this comment.
We'll need a description for this in server.en.yml
| @@ -35,3 +35,6 @@ discourse_openid_connect: | |||
| textarea: true | |||
| openid_connect_match_by_email: | |||
| default: true | |||
| openid_connect_use_pkce: | |||
| default: true | |||
There was a problem hiding this comment.
Setting this true by default could break existing installations which are incompatible with PKCE. We should make it false by default.
| default: true | |
| default: false |
Perhaps in future we could explore making it 'default true for new installations only'... but that can be a separate PR
| @@ -35,3 +35,6 @@ discourse_openid_connect: | |||
| textarea: true | |||
| openid_connect_match_by_email: | |||
| default: true | |||
| openid_connect_use_pkce: | |||
| default: true | |||
| client: true | |||
There was a problem hiding this comment.
| client: true |
The JS app does not need this site setting
There was a problem hiding this comment.
Happy to introduce this feature, but we will need to add some acceptance tests to verify the functionality and avoid future regressions. Is that something you have the capacity to work on @Jincoco88912?
|
@davidtaylorhq this can probably be closed |
Enable PKCE Support
Description
This pull request enables support for PKCE (Proof Key for Code Exchange) to enhance the security of OpenID Connect.
Changes
openid_connect_use_pkceconfiguration inconfig/settings.yml.lib/openid_connect_authenticator.rb, including:generate_code_verifiermethod: Generates a random code verifier.generate_code_challengemethod: Generates a code challenge based on the SHA256 algorithm.openid_connect_use_pkceconfiguration inplugin.rb.Testing
Additional Notes
These changes will enhance the security of OpenID Connect, especially in public client scenarios.