starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[PR #1812] [CLOSED] add PKCE verifier for OIDC #2332

New Issue
Closed
opened 2025-12-29 03:20:48 +01:00 by adam · 0 comments
adam commented 2025-12-29 03:20:48 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/juanfont/headscale/pull/1812
Author: @Rorical
Created: 3/5/2024
Status: ❌ Closed

Base: main ← Head: main

📝 Commits (2)

  • 8f43c94 feat: add PKCE verifier for OIDC
  • ef6d912 Add failing test case for tampered pkce verifier

📊 Changes

6 files changed (+448 additions, -18 deletions)

View changed files

📝 .github/workflows/test-integration.yaml (+2 -0)
📝 config-example.yaml (+5 -0)
📝 docs/ref/oidc.md (+11 -0)
📝 hscontrol/oidc.go (+53 -15)
📝 hscontrol/types/config.go (+28 -0)
📝 integration/auth_oidc_test.go (+349 -3)

📄 Description

https://www.rfc-editor.org/rfc/rfc7636.html
To fix the error "Could not exchange code for the token" when using the PKCE method, a verifier should be generated and used during the authentication process.

  • read the CONTRIBUTING guidelines
  • raised a GitHub issue or discussed it on the projects chat beforehand
  • added unit tests
  • added integration tests
  • updated documentation if needed
  • updated CHANGELOG.md

Summary by CodeRabbit

  • New Features

    • Enhanced OpenID Connect (OIDC) registration and callback process with Proof Key for Code Exchange (PKCE) for improved security.
    • Introduced a new data structure, RegistrationInfo, to manage OIDC-related information effectively.

  • Bug Fixes

    • Improved validation processes to ensure secure handling of authorization code exchanges.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/juanfont/headscale/pull/1812 **Author:** [@Rorical](https://github.com/Rorical) **Created:** 3/5/2024 **Status:** ❌ Closed **Base:** `main` ← **Head:** `main` --- ### 📝 Commits (2) - [`8f43c94`](https://github.com/juanfont/headscale/commit/8f43c94693ed46159393c712532e060088e98e0b) feat: add PKCE verifier for OIDC - [`ef6d912`](https://github.com/juanfont/headscale/commit/ef6d9127b6390bb6f5d56a997f1f52d389977d53) Add failing test case for tampered pkce verifier ### 📊 Changes **6 files changed** (+448 additions, -18 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/test-integration.yaml` (+2 -0) 📝 `config-example.yaml` (+5 -0) 📝 `docs/ref/oidc.md` (+11 -0) 📝 `hscontrol/oidc.go` (+53 -15) 📝 `hscontrol/types/config.go` (+28 -0) 📝 `integration/auth_oidc_test.go` (+349 -3) </details> ### 📄 Description https://www.rfc-editor.org/rfc/rfc7636.html To fix the error "Could not exchange code for the token" when using the PKCE method, a verifier should be generated and used during the authentication process. - [x] read the [CONTRIBUTING guidelines](README.md#contributing) - [ ] raised a GitHub issue or discussed it on the projects chat beforehand - [ ] added unit tests - [ ] added integration tests - [ ] updated documentation if needed - [ ] updated CHANGELOG.md <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Enhanced OpenID Connect (OIDC) registration and callback process with Proof Key for Code Exchange (PKCE) for improved security. - Introduced a new data structure, `RegistrationInfo`, to manage OIDC-related information effectively. - **Bug Fixes** - Improved validation processes to ensure secure handling of authorization code exchanges. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-29 03:20:48 +01:00
adam closed this issue 2025-12-29 03:20:48 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#2332
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?