[PR #4804] [MERGED] Add OIDC PKCE functionality #6407

New Issue

OVERLORD · 2026-02-05T10:31:29+03:00

OVERLORD commented

2026-02-05 10:31:29 +03:00

📋 Pull Request Information

Original PR: https://github.com/BookStackApp/BookStack/pull/4804
Author: @ssddanbrown
Created: 1/25/2024
Status: ✅ Merged
Merged: 1/27/2024
Merged by: @ssddanbrown

Base: development ← Head: oidc_pkce

📝 Commits (2)

3e9e196 OIDC: Added PKCE functionality
1dc094f OIDC: Added testing of PKCE flow

📊 Changes

3 files changed (+51 additions, -20 deletions)

View changed files

📝 app/Access/Oidc/OidcOAuthProvider.php (+12 -19)
📝 app/Access/Oidc/OidcService.php (+11 -1)
📝 tests/Auth/OidcTest.php (+28 -0)

📄 Description

Related to #4734.

Todo

Check full implementation and library against RFC spec.
Cover with PHPUnit testing.
Auth system checks (Check each with and without enforcement for post/after compatibility):
- Jumpcloud
  - Works fine, Could not force PKCE, fails when invalid.
- Okta
  - Works fine, allows forcing PKCE. Fails in expected cases of invalid/missing value, including invalid when not enforced.
- Auth0
  - Could not find option to force PKCE. Does fail with invalid PKCE in auth code request.
- Keycloak
  - Works fine, allows forcing PKCE (via specifying method) and fails without, and invalid when not enforced.
- Authentik
  - Could not find easy option to force PKCE, but does fail with invalid PKCE.
- Azure
  - Could not find option to force PKCE, but does fail with invalid PKCE.

Docs Updates

Update OIDC guidance to indicate support of PKCE, and advise enforcement where possible for extra security.
Update advisory to advise enforcement? Probably a good idea.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/BookStackApp/BookStack/pull/4804 **Author:** [@ssddanbrown](https://github.com/ssddanbrown) **Created:** 1/25/2024 **Status:** ✅ Merged **Merged:** 1/27/2024 **Merged by:** [@ssddanbrown](https://github.com/ssddanbrown) **Base:** `development` ← **Head:** `oidc_pkce` --- ### 📝 Commits (2) - [`3e9e196`](https://github.com/BookStackApp/BookStack/commit/3e9e196cdada5a6c515d5bbab971c80a90d333ab) OIDC: Added PKCE functionality - [`1dc094f`](https://github.com/BookStackApp/BookStack/commit/1dc094ffafc216e15c8355b400b21524137de5e4) OIDC: Added testing of PKCE flow ### 📊 Changes **3 files changed** (+51 additions, -20 deletions) <details> <summary>View changed files</summary> 📝 `app/Access/Oidc/OidcOAuthProvider.php` (+12 -19) 📝 `app/Access/Oidc/OidcService.php` (+11 -1) 📝 `tests/Auth/OidcTest.php` (+28 -0) </details> ### 📄 Description Related to #4734. ### Todo - [x] Check full implementation and library [against RFC spec](https://datatracker.ietf.org/doc/html/rfc7636). - [x] Cover with PHPUnit testing. - Auth system checks (Check each with and without enforcement for post/after compatibility): - [x] Jumpcloud - Works fine, Could not force PKCE, fails when invalid. - [x] Okta - Works fine, allows forcing PKCE. Fails in expected cases of invalid/missing value, including invalid when not enforced. - [x] Auth0 - Could not find option to force PKCE. Does fail with invalid PKCE in auth code request. - [x] Keycloak - Works fine, allows forcing PKCE (via specifying method) and fails without, and invalid when not enforced. - [x] Authentik - Could not find easy option to force PKCE, but does fail with invalid PKCE. - [x] Azure - Could not find option to force PKCE, but does fail with invalid PKCE. ### Docs Updates - Update OIDC guidance to indicate support of PKCE, and advise enforcement where possible for extra security. - Update advisory to advise enforcement? Probably a good idea. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

OVERLORD added the pull-request label 2026-02-05 10:31:29 +03:00

OVERLORD closed this issue

2026-02-05 10:31:31 +03:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#6407