Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OIDC tests use incorrect PKCE code_challenge computation #5991

Closed
aaronpk opened this issue Feb 23, 2022 · 0 comments · Fixed by #6210
Closed

OIDC tests use incorrect PKCE code_challenge computation #5991

aaronpk opened this issue Feb 23, 2022 · 0 comments · Fixed by #6210

Comments

@aaronpk
Copy link

aaronpk commented Feb 23, 2022

I noticed that all the OpenID Connect tests use the incorrect base64 encoding for the code challenge. For example:

identity-idp/spec/features/openid_connect/openid_connect_spec.rb

Line 343 in 4e96f3c

code_challenge = Digest::SHA256.base64digest(code_verifier) 

Digest::SHA256.base64digest

This is the traditional base64 encoding with URL-unsafe characters. Instead, the tests should use the URL-safe base64 encoding that is required by PKCE.
zachmargolis added a commit that referenced this issue Apr 15, 2022
@zachmargolis
Use URL-safe base64 encoding of SHA256 digest
33ff369 
**Why**: adheres to OIDC spec better

Fixes #5991
@zachmargolis zachmargolis mentioned this issue Apr 15, 2022
Merged
zachmargolis added a commit that referenced this issue Apr 15, 2022
@zachmargolis
Use URL-safe base64 encoding of SHA256 digest in examples (#6210)
e03a691 
**Why**: adheres to OIDC spec better

Fixes #5991

changelog: Internal, Encoding, Use URL-safe encoding of SHA256 digests to better match OIDC spec
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Use URL-safe base64 encoding of SHA256 digest in examples 18F/identity-idp
2 participants
@aaronpk and others