From 9036daecdc8bcdf8114715dcf17e5c06967b25fb Mon Sep 17 00:00:00 2001 From: Chris Coutinho Date: Mon, 13 Oct 2025 23:24:53 +0200 Subject: [PATCH 1/2] feat: Advertise PKCE support in discovery document Add code_challenge_methods_supported to OpenID Connect discovery document when PKCE is enabled via proof_key_for_code_exchange config. Rationale: According to RFC 8414 Section 2, the code_challenge_methods_supported field in OAuth 2.0 Authorization Server Metadata has specific semantics: "If omitted, the authorization server does not support PKCE." This means that clients following RFC 8414 strictly will interpret the absence of this field as explicit non-support for PKCE, even if the authorization server technically supports it. Impact: - Standards-compliant OAuth clients (e.g., MCP clients) require explicit advertisement of PKCE support before proceeding with authorization - The MCP (Model Context Protocol) specification mandates that clients MUST refuse to proceed if code_challenge_methods_supported is absent - Other security-focused OAuth implementations may have similar checks Implementation: - Only advertises S256 (SHA-256) challenge method, which is the most secure and widely supported method - Conditional on the existing proof_key_for_code_exchange app config - Maintains backward compatibility: only added when PKCE is enabled This change ensures the discovery document accurately reflects server capabilities per RFC 8414 semantics, enabling compatibility with strict standards-compliant OAuth clients. References: - RFC 8414: OAuth 2.0 Authorization Server Metadata - RFC 7636: Proof Key for Code Exchange by OAuth Public Clients - MCP Authorization Specification Signed-off-by: Chris Coutinho --- lib/Util/DiscoveryGenerator.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/lib/Util/DiscoveryGenerator.php b/lib/Util/DiscoveryGenerator.php index ee3cd57..6429f94 100644 --- a/lib/Util/DiscoveryGenerator.php +++ b/lib/Util/DiscoveryGenerator.php @@ -171,6 +171,11 @@ class DiscoveryGenerator $discoveryPayload['registration_endpoint'] = $host . $this->urlGenerator->linkToRoute('oidc.DynamicRegistration.registerClient', []); } + // Add PKCE support if enabled + if ($this->appConfig->getAppValueBool('proof_key_for_code_exchange', false)) { + $discoveryPayload['code_challenge_methods_supported'] = ['S256']; + } + $this->logger->info('Request to Discovery Endpoint.'); $response = new JSONResponse($discoveryPayload); -- 2.51.1