fix(auth): add PKCE to OpenID Connect login

Generate a per-login verifier, persist it in the Goth session, send an S256 challenge, and include the verifier during the token exchange when explicitly enabled. Assisted-by: Codex:GPT-5
2026-08-29 16:19:49 +08:00
parent 23b7c61eff
commit 746b23b098
7 changed files with 292 additions and 8 deletions
@@ -1725,6 +1725,9 @@ LEVEL = Info
 ;; For more information about the possible values see https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims
 ;OPENID_CONNECT_SCOPES =
 ;;
+;; Use Proof Key for Code Exchange (PKCE) with the S256 method for OpenID Connect login sources.
+;ENABLE_OPENID_CONNECT_PKCE = false
+;;
 ;; Automatically create user accounts for new oauth2 users.
 ;ENABLE_AUTO_REGISTRATION = false
 ;;