feat: add support for OAuth 2.0 Authorization Server Issuer Identification

backend/internal/controller/oidc_controller.go

@@ -89,6 +89,7 @@ func (oc *OidcController) authorizeHandler(c *gin.Context) {
 	response := dto.AuthorizeOidcClientResponseDto{
 		Code:        code,
 		CallbackURL: callbackURL,
+		Issuer:         common.EnvConfig.AppURL,
 	}
 
 	c.JSON(http.StatusOK, response)

backend/internal/controller/well_known_controller.go

@@ -83,6 +83,7 @@ func (wkc *WellKnownController) computeOIDCConfiguration() ([]byte, error) {
 		"response_types_supported":                       []string{"code", "id_token"},
 		"subject_types_supported":                        []string{"public"},
 		"id_token_signing_alg_values_supported":          []string{alg.String()},
+		"authorization_response_iss_parameter_supported": true,
 	}
 	return json.Marshal(config)
 }

backend/internal/dto/oidc_dto.go

@@ -57,6 +57,7 @@ type AuthorizeOidcClientRequestDto struct {
 type AuthorizeOidcClientResponseDto struct {
 	Code        string `json:"code"`
 	CallbackURL string `json:"callbackURL"`
+	Issuer         string `json:"issuer"`
 }
 
 type AuthorizationRequiredDto struct {

frontend/src/lib/types/oidc.type.ts

@@ -48,4 +48,5 @@ export type OidcDeviceCodeInfo = {
 export type AuthorizeResponse = {
 	code: string;
 	callbackURL: string;
+	issuer: string;
 };

frontend/src/routes/authorize/+page.svelte

@@ -57,8 +57,8 @@
 
 			await oidService
 				.authorize(client!.id, scope, callbackURL, nonce, codeChallenge, codeChallengeMethod)
-				.then(async ({ code, callbackURL }) => {
-					onSuccess(code, callbackURL);
+				.then(async ({ code, callbackURL, issuer }) => {
+					onSuccess(code, callbackURL, issuer);
 				});
 		} catch (e) {
 			errorMessage = getWebauthnErrorMessage(e);
@@ -66,12 +66,13 @@
 		}
 	}
 
-	function onSuccess(code: string, callbackURL: string) {
+	function onSuccess(code: string, callbackURL: string, issuer: string) {
 		success = true;
 		setTimeout(() => {
 			const redirectURL = new URL(callbackURL);
 			redirectURL.searchParams.append('code', code);
 			redirectURL.searchParams.append('state', authorizeState);
+			redirectURL.searchParams.append('iss', issuer);
 
 			window.location.href = redirectURL.toString();
 		}, 1000);