starred/pocket-id-pocket-id-2
1
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2025-12-09 22:52:58 +03:00
Code Issues 116 Packages Projects Releases 10 Wiki Activity

🚀 Feature: PKCE Support #459

New Issue
Closed
opened 2025-10-09 16:47:56 +03:00 by OVERLORD · 4 comments
OVERLORD commented 2025-10-09 16:47:56 +03:00
Owner
Copy Link

Originally created by @stonith404 on GitHub.

Feature description

Implement PKCE for OIDC.

Pitch

When public clients (e.g., native and single-page applications) request access tokens, some additional security concerns are posed that are not mitigated by the Authorization Code Flow alone. Because of that PKCE should be supported by Pocket ID.

Originally created by @stonith404 on GitHub. ### Feature description Implement PKCE for OIDC. ### Pitch When public clients (e.g., native and single-page applications) request access tokens, some additional security concerns are posed that are not mitigated by the Authorization Code Flow alone. Because of that PKCE should be supported by Pocket ID.
OVERLORD added the feature label 2025-10-09 16:47:56 +03:00
OVERLORD commented 2025-10-09 16:47:59 +03:00
Author
Owner
Copy Link

@stonith404 commented on GitHub:

@cdemi Would you mind to test the stonith404/pocket-id:development image? PKCE should work in this image.

@stonith404 commented on GitHub: @cdemi Would you mind to test the `stonith404/pocket-id:development` image? PKCE should work in this image.
OVERLORD commented 2025-10-09 16:47:59 +03:00
Author
Owner
Copy Link

@stonith404 commented on GitHub:

Added in v0.15.0.

@stonith404 commented on GitHub: Added in `v0.15.0`.
OVERLORD commented 2025-10-09 16:47:59 +03:00
Author
Owner
Copy Link

@cdemi commented on GitHub:

I have spun up the development image and testing it out against https://oidcdebugger.com/ and I still get a CORS error: Access to XMLHttpRequest at 'https://mypocketid.domain/api/oidc/token' from origin 'https://oidcdebugger.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource

Server logs and browser show 403 on /api/oidc/token:

pocketid | [GIN] 2024/11/15 - 15:54:14 | 403 | 57.157µs | xxx.xxx.xxx.xxx | POST "/api/oidc/token"

@cdemi commented on GitHub: I have spun up the `development` image and testing it out against https://oidcdebugger.com/ and I still get a CORS error: `Access to XMLHttpRequest at 'https://mypocketid.domain/api/oidc/token' from origin 'https://oidcdebugger.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource` Server logs and browser show `403` on `/api/oidc/token`: `pocketid | [GIN] 2024/11/15 - 15:54:14 | 403 | 57.157µs | xxx.xxx.xxx.xxx | POST "/api/oidc/token"`
OVERLORD commented 2025-10-09 16:48:02 +03:00
Author
Owner
Copy Link

@stonith404 commented on GitHub:

Thanks, I made some changes and now it should work. Could you try the new development image again?

You now have to set your OIDC client to public in the OIDC client settings, to enable PKCE:
Screenshot 2024-11-16 at 19 59 00@2x

I made some changes to the migration, so please run the following command after you've updated the image:

sqlite3 data/pocket-id.db "ALTER TABLE oidc_clients ADD COLUMN is_public BOOLEAN DEFAULT FALSE;"
@stonith404 commented on GitHub: Thanks, I made some changes and now it should work. Could you try the new `development` image again? You now have to set your OIDC client to public in the OIDC client settings, to enable PKCE: ![Screenshot 2024-11-16 at 19 59 00@2x](https://github.com/user-attachments/assets/b2bde629-afc0-447f-a90b-5a35e15e4ae4) I made some changes to the migration, so please run the following command after you've updated the image: ```sh sqlite3 data/pocket-id.db "ALTER TABLE oidc_clients ADD COLUMN is_public BOOLEAN DEFAULT FALSE;" ```
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
breaking
bug
documentation
feature
needs more upvotes
open to pull requests
pull-request
Mirrored from GitHub Pull Request
No Label feature
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/pocket-id-pocket-id-2#459
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?