[5.x] Add support for OAuth 2.0 PKCE extension #518
Conversation
* adds the PKCE logic in the core OAuth 2 provider * enables PKCE with Google
| $this->assertSame('http://auth.url?client_id=client_id&redirect_uri=redirect&scope=&response_type=code&state='.$state, $response->getTargetUrl()); | ||
| } | ||
|
|
||
| private static $codeVerifier = null; |
There was a problem hiding this comment.
I was unclear on how to get this value stored in the test in a local variable, it seemed to only work when stored as a static class variable. The test needs to know the value the main library generated, and also needs to be able to return it to the main library when pulled from the session. Let me know if there is a better way to do this, it was very difficult to find any docs on how to do this kind of test.
There was a problem hiding this comment.
You should be able to move this into the test method itself like this:
public function testRedirectGeneratesTheProperIlluminateRedirectResponseWithPKCE()
{
static $codeVerifier = null;There was a problem hiding this comment.
Strangely that isn't working. The first closure sets that value, but then it appears to be null by the time the second closure goes to read it.
driesvints
changed the title
Co-authored-by: Dries Vints <[email protected]>
|
Thanks @aaronpk. A PR to the docs is appreciated as well 🙂 |
|
@taylorotwell please check the above comments, the merged version contains a couple of typo's as per @wietsewarendorff's comment. |
|
Here's the fix: #520 |
* fix PKCE for token request (follow up on #518) * adds test for PKCE token endpoint request * make the linter happy
|
Follow up for stateless apps here: #523 |
This PR adds support for the OAuth 2.0 PKCE extension, as discussed in #483. This extension is recommended in the latest version of the OAuth 2.0 Security Best Current Practice.
usesPKCEproperty on the providerfalse, which is the safer way to handle backwards compatibility, even though technically OAuth providers are supposed to ignore unknown parameters so it should be theoretically possible to always send the PKCE parameters anyway