PKCE support for SSO #5189
PKCE support for SSO #5189
Conversation
avdb13
requested review from
Nutomic,
dessalines,
phiresky,
dullbananas and
SleeplessOne1917
as code owners
avdb13
force-pushed
the
pkce
branch
2 times, most recently
from
5dda4a1
to
7fc1ead
Compare
|
@privacyguard Could you have a look at this? |
|
Frontend PR: LemmyNet/lemmy-ui#2806 |
crates/api_crud/src/user/create.rs
Outdated
| &context, | ||
| &oauth_provider, | ||
| &data.code, | ||
| data.pkce_code_verifier.as_deref(), |
There was a problem hiding this comment.
We should probably make sure the provider has use_pkce enabled before accepting the pkce_code_verifier parameter from the client.
There was a problem hiding this comment.
Also the pkce_code_verifier must be validated here against the PKCE allowed characters.
code_verifier = high-entropy cryptographic random STRING using the
unreserved characters [A-Z] / [a-z] / [0-9] / "-" / "." / "_" / "~"
from Section 2.3 of [RFC3986], with a minimum length of 43 characters
and a maximum length of 128 characters.
| @@ -57,6 +57,8 @@ pub struct OAuthProvider { | |||
| pub auto_verify_email: bool, | |||
| /// Allows linking an OAUTH account to an existing user account by matching emails | |||
| pub account_linking_enabled: bool, | |||
| /// switch to enable or disable PKCE | |||
| pub use_pkce: bool, | |||
There was a problem hiding this comment.
use_pkce should also be added to the serialized fields in the PublicOAuthProvider. This will be required by the client to be able to check whether or not code_verifier should be generated for the provider in question at login time.
|
@Nutomic overall the server changes to support PKCE are: We gave our feedback on the functionality aspect. We'll let the rust experts give their feedback on the code. We also gave feedback on the frontend PR. |
|
@avdb13 If you check the comments on the SSO PR, there are a couple of comments detailing the steps needed to test locally. If you're using Privacy Portal to test, don't forget to enable PKCE in the OAUTH app settings there too. |
Description
In continuation of #4881.
Implements PKCE support, in order to mitigate against the threat of authorization code interception attacks.
Background reading: https://www.oauth.com/oauth2-servers/pkce