Skip to content

OIDC PKCE implementation #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Jappie3 wants to merge 1 commit into
base: feat/oidc-login
Choose a base branch
from
Open

OIDC PKCE implementation #6

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 49 additions & 3 deletions server/utils/oidc.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ import type {
import type { OidcProvider } from '@server/lib/settings';
import type { Request } from 'express';
import * as yup from 'yup';
import * as crypto from 'crypto';

/** Fetch the issuer configuration from the OpenID Connect Discovery endpoint */
export async function getOpenIdConfiguration(domain: string) {
Expand Down Expand Up @@ -34,6 +35,8 @@ function getOpenIdCallbackUrl(req: Request, provider: OidcProvider) {
return callbackUrl.toString();
}

const getPkceSessionKey = () => 'oidc_pkce_data';

/** Generate authentication request url */
export async function getOpenIdRedirectUrl(
req: Request,
Expand All @@ -42,12 +45,35 @@ export async function getOpenIdRedirectUrl(
) {
const wellKnownInfo = await getOpenIdConfiguration(provider.issuerUrl);
const url = new URL(wellKnownInfo.authorization_endpoint);

// PKCE values
const codeVerifier = crypto.randomBytes(43).toString('base64')
.replace(/\+/g, '-')
.replace(/\//g, '_')
.replace(/=/g, '');
const codeChallenge = crypto.createHash('sha256')
.update(codeVerifier)
.digest('base64')
.replace(/\+/g, '-')
.replace(/\//g, '_')
.replace(/=/g, '');

// store PKCE values using key
(req.session as any)[getPkceSessionKey()] = {
codeVerifier,
challengeMethod: 'S256',
};

url.searchParams.set('response_type', 'code');
url.searchParams.set('client_id', provider.clientId);

url.searchParams.set('redirect_uri', getOpenIdCallbackUrl(req, provider));
url.searchParams.set('scope', provider.scopes ?? 'openid profile email');
url.searchParams.set('state', state);

url.searchParams.set('code_challenge', codeChallenge);
url.searchParams.set('code_challenge_method', 'S256');

return url.toString();
}

Expand All @@ -65,10 +91,30 @@ export async function fetchOpenIdTokenData(
formData.append('client_id', provider.clientId);
formData.append('code', code);

return await fetch(wellKnownInfo.token_endpoint, {
// retrieve PKCE values
const pkceData = (req.session as any)[getPkceSessionKey()];
if (!pkceData) {
throw new OidcAuthorizationError('Missing PKCE session data');
}
formData.append('code_verifier', pkceData.codeVerifier);

const response = await fetch(wellKnownInfo.token_endpoint, {
method: 'POST',
body: formData,
}).then((r) => r.json());
body: formData.toString(),
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
});

if (!response.ok) {
throw new OidcAuthorizationError(`Token endpoint returned ${response.status}`);
}

const tokenResponse = await response.json();
// clear PKCE data after successful exchange
delete (req.session as any)[getPkceSessionKey()];

return tokenResponse;
}

export async function getOpenIdUserInfo(
Expand Down