64 lines
2.5 KiB
Diff
64 lines
2.5 KiB
Diff
From 9036daecdc8bcdf8114715dcf17e5c06967b25fb Mon Sep 17 00:00:00 2001
|
|
From: Chris Coutinho <chris@coutinho.io>
|
|
Date: Mon, 13 Oct 2025 23:24:53 +0200
|
|
Subject: [PATCH 1/2] feat: Advertise PKCE support in discovery document
|
|
|
|
Add code_challenge_methods_supported to OpenID Connect discovery
|
|
document when PKCE is enabled via proof_key_for_code_exchange config.
|
|
|
|
Rationale:
|
|
According to RFC 8414 Section 2, the code_challenge_methods_supported
|
|
field in OAuth 2.0 Authorization Server Metadata has specific semantics:
|
|
"If omitted, the authorization server does not support PKCE."
|
|
|
|
This means that clients following RFC 8414 strictly will interpret the
|
|
absence of this field as explicit non-support for PKCE, even if the
|
|
authorization server technically supports it.
|
|
|
|
Impact:
|
|
- Standards-compliant OAuth clients (e.g., MCP clients) require explicit
|
|
advertisement of PKCE support before proceeding with authorization
|
|
- The MCP (Model Context Protocol) specification mandates that clients
|
|
MUST refuse to proceed if code_challenge_methods_supported is absent
|
|
- Other security-focused OAuth implementations may have similar checks
|
|
|
|
Implementation:
|
|
- Only advertises S256 (SHA-256) challenge method, which is the most
|
|
secure and widely supported method
|
|
- Conditional on the existing proof_key_for_code_exchange app config
|
|
- Maintains backward compatibility: only added when PKCE is enabled
|
|
|
|
This change ensures the discovery document accurately reflects server
|
|
capabilities per RFC 8414 semantics, enabling compatibility with
|
|
strict standards-compliant OAuth clients.
|
|
|
|
References:
|
|
- RFC 8414: OAuth 2.0 Authorization Server Metadata
|
|
- RFC 7636: Proof Key for Code Exchange by OAuth Public Clients
|
|
- MCP Authorization Specification
|
|
|
|
Signed-off-by: Chris Coutinho <chris@coutinho.io>
|
|
---
|
|
lib/Util/DiscoveryGenerator.php | 5 +++++
|
|
1 file changed, 5 insertions(+)
|
|
|
|
diff --git a/lib/Util/DiscoveryGenerator.php b/lib/Util/DiscoveryGenerator.php
|
|
index ee3cd57..6429f94 100644
|
|
--- a/lib/Util/DiscoveryGenerator.php
|
|
+++ b/lib/Util/DiscoveryGenerator.php
|
|
@@ -171,6 +171,11 @@ class DiscoveryGenerator
|
|
$discoveryPayload['registration_endpoint'] = $host . $this->urlGenerator->linkToRoute('oidc.DynamicRegistration.registerClient', []);
|
|
}
|
|
|
|
+ // Add PKCE support if enabled
|
|
+ if ($this->appConfig->getAppValueBool('proof_key_for_code_exchange', false)) {
|
|
+ $discoveryPayload['code_challenge_methods_supported'] = ['S256'];
|
|
+ }
|
|
+
|
|
$this->logger->info('Request to Discovery Endpoint.');
|
|
|
|
$response = new JSONResponse($discoveryPayload);
|
|
--
|
|
2.51.1
|
|
|