From 8a035c8d82e8a04ee229de278940130cbba89406 Mon Sep 17 00:00:00 2001
From: x <x032205@gmail.com>
Date: Mon, 28 Apr 2025 12:51:18 -0400
Subject: [PATCH] check if OIDC provider supports PKCE before applying it

---
 backend/src/ee/services/oidc/oidc-config-service.ts | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/backend/src/ee/services/oidc/oidc-config-service.ts b/backend/src/ee/services/oidc/oidc-config-service.ts
index 4709a1930..ce702fc95 100644
--- a/backend/src/ee/services/oidc/oidc-config-service.ts
+++ b/backend/src/ee/services/oidc/oidc-config-service.ts
@@ -685,14 +685,17 @@ export const oidcConfigServiceFactory = ({
       id_token_signed_response_alg: oidcCfg.jwtSignatureAlgorithm
     });
 
+    // Check if the OIDC provider supports PKCE
+    const codeChallengeMethods = client.issuer.metadata.code_challenge_methods_supported;
+    const supportsPKCE =
+      !codeChallengeMethods || (Array.isArray(codeChallengeMethods) && codeChallengeMethods.includes("S256"));
+
     const strategy = new OpenIdStrategy(
       {
         client,
         passReqToCallback: true,
-        usePKCE: true,
-        params: {
-          code_challenge_method: "S256"
-        }
+        usePKCE: supportsPKCE,
+        params: supportsPKCE ? { code_challenge_method: "S256" } : undefined
       },
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       (_req: any, tokenSet: TokenSet, cb: any) => {