Add support for PKCE

Created on 4 February 2025, 2 months ago

Problem/Motivation

The base league/oauth2_client has PKCE support, but this is not exposed in the module.

Steps to reproduce

Attempt to authenticate to an oauth2 server that requires PKCE produces the error "Use of PKCE is required"

Proposed resolution

Follow the steps in the usage guide to add PKCE support.

Remaining tasks

User interface changes

API changes

Data model changes

✨ Feature request
Status

Active

Version

4.1

Component

Code

Created by

πŸ‡ΊπŸ‡ΈUnited States lieb

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @lieb
  • πŸ‡ΊπŸ‡ΈUnited States lieb

    I got it working with one mod

    src/Plugin/Oauth2Client/Oauth2ClientPluginBase.php

    public function getProvider(): AbstractProvider {
        return new GenericProvider(
    	[
    		...				
    		'pkceMethod' => \League\OAuth2\Client\Provider\GenericProvider::PKCE_METHOD_S256,
    	],

    However I am not storing and retrieving the code as per the documentation

    From the documentation - https://oauth2-client.thephpleague.com/usage/

    $provider = new \League\OAuth2\Client\Provider\GenericProvider([

     // ...
        // other options
        // ...
        'pkceMethod' => \League\OAuth2\Client\Provider\GenericProvider::PKCE_METHOD_S256
    ]);

    The PKCE code needs to be used between requests and therefore be saved and restored, usually via the session. In the example above this is done as follows:

    // Store the PKCE code after the `getAuthorizationUrl()` call.
    $_SESSION['oauth2pkceCode'] = $provider->getPkceCode();
    // ...
    // Restore the PKCE code before the `getAccessToken()` call. 
    $provider->setPkceCode($_SESSION['oauth2pkceCode']);
    
  • πŸ‡ΊπŸ‡ΈUnited States fathershawn New York

    Hi - That's precisely the approach - to customize the provider as you need in your implementation!

    For storage you can you use similar methods to the token storage and use which ever method you chose for that to store this code.

    I plan to switch to the new GitLab pages soon - thank you for this question as it will be a good case to document.

  • πŸ‡ΊπŸ‡ΈUnited States fathershawn New York
  • πŸ‡ΊπŸ‡ΈUnited States fathershawn New York

    I've given this some thought and want to make this easier for users to implement.

  • πŸ‡ΊπŸ‡ΈUnited States fathershawn New York
Production build 0.71.5 2024