awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

check if OIDC provider supports PKCE before applying it

Browse Source
This commit is contained in:
x
2025-04-28 12:51:18 -04:00
parent 03d7f9f786
commit 8a035c8d82
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
backend/src/ee/services/oidc/oidc-config-service.ts
View File

@@ -685,14 +685,17 @@ export const oidcConfigServiceFactory = ({
id_token_signed_response_alg: oidcCfg.jwtSignatureAlgorithm id_token_signed_response_alg: oidcCfg.jwtSignatureAlgorithm
}); });
// Check if the OIDC provider supports PKCE
const codeChallengeMethods = client.issuer.metadata.code_challenge_methods_supported;
const supportsPKCE =
!codeChallengeMethods || (Array.isArray(codeChallengeMethods) && codeChallengeMethods.includes("S256"));
const strategy = new OpenIdStrategy( const strategy = new OpenIdStrategy(
{ {
client, client,
passReqToCallback: true, passReqToCallback: true,
usePKCE: true, usePKCE: supportsPKCE,
params: { params: supportsPKCE ? { code_challenge_method: "S256" } : undefined
code_challenge_method: "S256"
}
}, },
// eslint-disable-next-line @typescript-eslint/no-explicit-any // eslint-disable-next-line @typescript-eslint/no-explicit-any
(_req: any, tokenSet: TokenSet, cb: any) => { (_req: any, tokenSet: TokenSet, cb: any) => {