🚀 Feature: PKCE Support #60

New Issue

OVERLORD · 2026-02-04T17:00:25+03:00

OVERLORD commented

2026-02-04 17:00:25 +03:00

Originally created by @stonith404 on GitHub (Nov 15, 2024).

Feature description

Implement PKCE for OIDC.

Pitch

When public clients (e.g., native and single-page applications) request access tokens, some additional security concerns are posed that are not mitigated by the Authorization Code Flow alone. Because of that PKCE should be supported by Pocket ID.

Originally created by @stonith404 on GitHub (Nov 15, 2024). ### Feature description Implement PKCE for OIDC. ### Pitch When public clients (e.g., native and single-page applications) request access tokens, some additional security concerns are posed that are not mitigated by the Authorization Code Flow alone. Because of that PKCE should be supported by Pocket ID.

OVERLORD added the feature label 2026-02-04 17:00:25 +03:00

OVERLORD closed this issue

2026-02-04 17:00:25 +03:00

OVERLORD commented

2026-02-04 17:00:34 +03:00

@stonith404 commented on GitHub (Nov 15, 2024):

@cdemi Would you mind to test the stonith404/pocket-id:development image? PKCE should work in this image.

@stonith404 commented on GitHub (Nov 15, 2024): @cdemi Would you mind to test the `stonith404/pocket-id:development` image? PKCE should work in this image.

OVERLORD commented

2026-02-04 17:00:46 +03:00

@cdemi commented on GitHub (Nov 15, 2024):

I have spun up the development image and testing it out against https://oidcdebugger.com/ and I still get a CORS error: Access to XMLHttpRequest at 'https://mypocketid.domain/api/oidc/token' from origin 'https://oidcdebugger.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource

Server logs and browser show 403 on /api/oidc/token:

pocketid | [GIN] 2024/11/15 - 15:54:14 | 403 | 57.157µs | xxx.xxx.xxx.xxx | POST "/api/oidc/token"

@cdemi commented on GitHub (Nov 15, 2024): I have spun up the `development` image and testing it out against https://oidcdebugger.com/ and I still get a CORS error: `Access to XMLHttpRequest at 'https://mypocketid.domain/api/oidc/token' from origin 'https://oidcdebugger.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource` Server logs and browser show `403` on `/api/oidc/token`: `pocketid | [GIN] 2024/11/15 - 15:54:14 | 403 | 57.157µs | xxx.xxx.xxx.xxx | POST "/api/oidc/token"`

OVERLORD commented

2026-02-04 17:00:52 +03:00

@stonith404 commented on GitHub (Nov 16, 2024):

Thanks, I made some changes and now it should work. Could you try the new development image again?

You now have to set your OIDC client to public in the OIDC client settings, to enable PKCE:

I made some changes to the migration, so please run the following command after you've updated the image:

sqlite3 data/pocket-id.db "ALTER TABLE oidc_clients ADD COLUMN is_public BOOLEAN DEFAULT FALSE;"

@stonith404 commented on GitHub (Nov 16, 2024): Thanks, I made some changes and now it should work. Could you try the new `development` image again? You now have to set your OIDC client to public in the OIDC client settings, to enable PKCE: ![Screenshot 2024-11-16 at 19 59 00@2x](https://github.com/user-attachments/assets/b2bde629-afc0-447f-a90b-5a35e15e4ae4) I made some changes to the migration, so please run the following command after you've updated the image: ```sh sqlite3 data/pocket-id.db "ALTER TABLE oidc_clients ADD COLUMN is_public BOOLEAN DEFAULT FALSE;" ```

OVERLORD commented

2026-02-04 17:00:58 +03:00

@stonith404 commented on GitHub (Nov 21, 2024):

Added in v0.15.0.

@stonith404 commented on GitHub (Nov 21, 2024): Added in `v0.15.0`.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/pocket-id#60