starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[PR #2314] [MERGED] feat: Add PKCE Verifier for OIDC #2602

New Issue
Closed
opened 2025-12-29 03:21:59 +01:00 by adam · 0 comments
adam commented 2025-12-29 03:21:59 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/juanfont/headscale/pull/2314
Author: @Rorical
Created: 12/22/2024
Status: ✅ Merged
Merged: 12/22/2024
Merged by: @kradalby

Base: main ← Head: pkce-verifier

📝 Commits (2)

  • 80df0c8 feat: add PKCE verifier for OIDC
  • 1aeb5e0 Update CHANGELOG.md

📊 Changes

7 files changed (+187 additions, -15 deletions)

View changed files

📝 .github/workflows/test-integration.yaml (+1 -0)
📝 CHANGELOG.md (+1 -0)
📝 config-example.yaml (+12 -0)
📝 docs/ref/oidc.md (+12 -0)
📝 hscontrol/oidc.go (+53 -15)
📝 hscontrol/types/config.go (+28 -0)
📝 integration/auth_oidc_test.go (+80 -0)

📄 Description

From PR #1812 :

To fix the error "Could not exchange code for the token" when using the PKCE method, a verifier should be generated and used during the authentication process.

This change include change in configuration, oidc handling method and documents.

oidc:
  # Optional: PKCE (Proof Key for Code Exchange) configuration
  # PKCE adds an additional layer of security to the OAuth 2.0 authorization code flow
  # by preventing authorization code interception attacks
  # See https://datatracker.ietf.org/doc/html/rfc7636
  pkce:
    # Enable or disable PKCE support (default: false)
    enabled: false
    # PKCE method to use:
    # - plain: Use plain code verifier
    # - S256: Use SHA256 hashed code verifier (default, recommended)
    method: S256

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/juanfont/headscale/pull/2314 **Author:** [@Rorical](https://github.com/Rorical) **Created:** 12/22/2024 **Status:** ✅ Merged **Merged:** 12/22/2024 **Merged by:** [@kradalby](https://github.com/kradalby) **Base:** `main` ← **Head:** `pkce-verifier` --- ### 📝 Commits (2) - [`80df0c8`](https://github.com/juanfont/headscale/commit/80df0c87a4f16af3b66a8c4b06960f886c24df93) feat: add PKCE verifier for OIDC - [`1aeb5e0`](https://github.com/juanfont/headscale/commit/1aeb5e00cd31fb8887e3feef9f81f48eae22af79) Update CHANGELOG.md ### 📊 Changes **7 files changed** (+187 additions, -15 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/test-integration.yaml` (+1 -0) 📝 `CHANGELOG.md` (+1 -0) 📝 `config-example.yaml` (+12 -0) 📝 `docs/ref/oidc.md` (+12 -0) 📝 `hscontrol/oidc.go` (+53 -15) 📝 `hscontrol/types/config.go` (+28 -0) 📝 `integration/auth_oidc_test.go` (+80 -0) </details> ### 📄 Description From PR #1812 : To fix the error "Could not exchange code for the token" when using the PKCE method, a verifier should be generated and used during the authentication process. This change include change in configuration, oidc handling method and documents. ```yaml oidc: # Optional: PKCE (Proof Key for Code Exchange) configuration # PKCE adds an additional layer of security to the OAuth 2.0 authorization code flow # by preventing authorization code interception attacks # See https://datatracker.ietf.org/doc/html/rfc7636 pkce: # Enable or disable PKCE support (default: false) enabled: false # PKCE method to use: # - plain: Use plain code verifier # - S256: Use SHA256 hashed code verifier (default, recommended) method: S256 ``` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-29 03:21:59 +01:00
adam closed this issue 2025-12-29 03:21:59 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#2602
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?