[DRAFT] Set and check nonce during authentication sequence. #840
Conversation
|
@dan1elt0m - proposed enhancement to add |
|
LGTM |
|
If I understand correctly, the nonce is intended to link the client (the relying party in OIDC terms) session with the issued ID token. In this context, where the CLI application functions as the client, and considering that the same CLI application is not executed after the ID Token is issued (meaning there is virtually no opportunity for an attacker to perform a replay attack), it seems that verifying the nonce may not add significant value. Additionally, in OAuth, the nonce is not a required parameter for authorization flows. I believe the primary concern here may not be a replay attack but rather an authorization code interception, MITM, and CSRF. Would it be more appropriate to consider implementing an authorization flow with PKCE instead of using a nonce? 🤔 |
|
Nonce provides replay protection and according to Google's openid-connect documentation, the nonce is required for both the server (auth code flow) and the implicit flow. IIRC, in the auth code flow it prevents hackers from injecting their auth response into the redirect URI of the server. |
|
The "client" mentioned above was intended to function as a client for the resource server. Strictly speaking, this CLI application ( Although I am uncertain about the rationale behind Google's documentation specifying nonce as required, the OIDC specifications referenced in the same documentation appear to indicate that nonce is optional in the authorization code flow. In this CLI application case, PKCE + state seems to provide sufficient security. That said, I do not have a strong objection to this draft. |
|
@ognis1205 @dan1elt0m I can see both your points. I don't think there is any particular not to do this, however optional and unlikely a replay attack could be. |
|
As mentioned in the comment here, if we continue using the current implementation of the Authorization Code Flow in However, if we replace it with the Authorization Code Flow with PKCE (PKCE Flow) and remove the That said, in Google's OIDC implementation, the Additionally, since the UI implementation for both Google and Okta clients is equivalent to the Authorization Code Flow with PKCE, adopting this approach would enhance consistency across the system as a whole. Google OIDC Configuration Enpoint |
PR Checklist
docsis updatedDescription of changes
This fixes a potential replay attack by setting a
noncevalue and validating thenonceis returned in the id-token.