cim/zitadel-oidc
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: check PKCE even when the Auth Method is not “none”.

Browse source
This commit is contained in:
Ayato 2025-03-01 22:01:42 +09:00
parent 6a80712fbe
commit acfc8ad99b
No known key found for this signature in database
GPG key ID: 56E05AE09DBA012D
2 changed files with 28 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

20
pkg/op/token_code.go
View file

@ -84,6 +84,16 @@ func AuthorizeCodeClient(ctx context.Context, tokenReq *oidc.AccessTokenRequest,
return nil, nil, err
}
request, err = AuthRequestByCode(ctx, exchanger.Storage(), tokenReq.Code)
codeChallenge := request.GetCodeChallenge()
if codeChallenge != nil && codeChallenge.Challenge != "" {
err = AuthorizeCodeChallenge(tokenReq.CodeVerifier, request.GetCodeChallenge())
if err != nil {
return nil, nil, err
}
}
return request, client, err
}
client, err = exchanger.Storage().GetClientByClientID(ctx, tokenReq.ClientID)
@ -109,6 +119,16 @@ func AuthorizeCodeClient(ctx context.Context, tokenReq *oidc.AccessTokenRequest,
return nil, nil, err
}
request, err = AuthRequestByCode(ctx, exchanger.Storage(), tokenReq.Code)
codeChallenge := request.GetCodeChallenge()
if codeChallenge != nil && codeChallenge.Challenge != "" {
err = AuthorizeCodeChallenge(tokenReq.CodeVerifier, request.GetCodeChallenge())
if err != nil {
return nil, nil, err
}
}
return request, client, err
}