Add additional requisites to support PKCE challenge (code_challenge_m… #507
Conversation
…ethod: implicit (default), S256 and plain). Made the login async to support nested promise (breaking-change?) 2 additional pieces of metadata included from options to be carried over response_mode and acr_values. (There may be more - but this is what I currently know) I've maintained the current formatting and styling as best I could. Example usage: myauthority: { scheme: 'oauth2', authorization_endpoint:[your endpoint], access_token_endpoint:[your endpoint], ... code_challenge_method:'S256', acr_values: 'UserType:something meaningful:info', response_mode: 'query' } Inspiration and resources: https://developer.okta.com/blog/2019/05/01/is-the-oauth-implicit-flow-dead https://www.oauth.com/oauth2-servers/pkce/ 
Codecov Report
@@ Coverage Diff @@ ## dev #507 +/- ## ========================================= Coverage 100.00% 100.00% ========================================= Files 1 1 Lines 2 2 ========================================= Hits 2 2 Continue to review full report at Codecov.
|
| This sounds good to me, can you update the documentation as well please? I let @pi0 review this PR since he knows better than me this module |
docs: add video totourial (nuxt-community#477)
| I added the additional parameters to the markdown file, along with additional reference links. I found that I needed to add the original code_verification parameter to the token request (during testing). So I included that as well. Let me know if there is anything else that is required I will try and check back more frequently. Thanks. |
…nto nuxt-community-dev # Conflicts: # docs/schemes/oauth2.md # lib/schemes/oauth2.js
| Any reviewers available? Already on another project and would like to see this pulled in. Thanks. |
JoaoPedroAS51 left a comment
JoaoPedroAS51 left a comment There was a problem hiding this comment.
Hi! Thank you for the PR! Nice work! 😃 I left some comments.
…resh doesn't appear to require code_challenge (same flow applies)
| Hi @madmonkey! I manually merged this PR due to branch conflicts :) baf9b57 |
|
Apologies, I did more reading, prep for v5 occuring https://www.npmjs.com/package/@nuxtjs/auth-next |
6 participants
…ethod: implicit (default), S256 and plain). Made the login async to support nested promise (breaking-change?)
2 additional pieces of metadata included from options to be carried over response_mode and acr_values. (There may be more - but this is what I currently know) I've maintained the current formatting and styling as best I could.
Inspiration and resources:
https://developer.okta.com/blog/2019/05/01/is-the-oauth-implicit-flow-dead
https://www.oauth.com/oauth2-servers/pkce/