opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat!: support PKCE in the oauth2 client's auth/exchange flow (#21215)

Browse Source 
**Breaking Change:** Existing oauth apps might now use PKCE. If an
unknown IdP type was being used, and it does not support PKCE, it will
break.

To fix, set the PKCE methods on the external auth to `none`
```
export CODER_EXTERNAL_AUTH_1_PKCE_METHODS=none
```
This commit is contained in:
Steven Masley
2025-12-15 17:41:47 +00:00
committed by GitHub
parent 3194bcfc9e
commit 8fefd91e4a
26 changed files with 473 additions and 169 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/admin/external-auth/index.md
+17
View File
@@ -133,6 +133,23 @@ You must add the SSH key to your Git provider.
- [GitHub](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account#adding-a-new-ssh-key-to-your-account)
- [GitLab](https://docs.gitlab.com/user/ssh/#add-an-ssh-key-to-your-gitlab-account)
## PKCE Support
[PKCE (Proof Key for Code Exchange)](https://datatracker.ietf.org/doc/html/rfc7636) is an OAuth 2.0
security extension that prevents authorization code interception attacks. Coder supports PKCE when
acting as an OAuth client to external identity providers.
Coder will usually assume PKCE support is available with "S256" as the code challenge method. Manual
configuration is available to override any default behavior.
```env
# Enable PKCE with S256 (recommended when supported)
CODER_EXTERNAL_AUTH_0_PKCE_METHODS="S256"
# Disable PKCE entirely
CODER_EXTERNAL_AUTH_0_PKCE_METHODS="none"
```
## Git-provider specific env variables
### Azure DevOps
docs/reference/api/general.md
Generated
+3
View File
@@ -262,6 +262,9 @@ curl -X GET http://coder-server:8080/api/v2/deployment/config \
"app_installations_url": "string",
"auth_url": "string",
"client_id": "string",
"code_challenge_methods_supported": [
"string"
],
"device_code_url": "string",
"device_flow": true,
"display_icon": "string",
docs/reference/api/schemas.md
Generated
+28 -15
View File
@@ -2952,6 +2952,9 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
"app_installations_url": "string",
"auth_url": "string",
"client_id": "string",
"code_challenge_methods_supported": [
"string"
],
"device_code_url": "string",
"device_flow": true,
"display_icon": "string",
@@ -3480,6 +3483,9 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
"app_installations_url": "string",
"auth_url": "string",
"client_id": "string",
"code_challenge_methods_supported": [
"string"
],
"device_code_url": "string",
"device_flow": true,
"display_icon": "string",
@@ -4219,6 +4225,9 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
"app_installations_url": "string",
"auth_url": "string",
"client_id": "string",
"code_challenge_methods_supported": [
"string"
],
"device_code_url": "string",
"device_flow": true,
"display_icon": "string",
@@ -4241,21 +4250,22 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
### Properties
| Name | Type | Required | Restrictions | Description |
|-------------------------|---------|----------|--------------|-----------------------------------------------------------------------------------------|
| `app_install_url` | string | false | | |
| `app_installations_url` | string | false | | |
| `auth_url` | string | false | | |
| `client_id` | string | false | | |
| `device_code_url` | string | false | | |
| `device_flow` | boolean | false | | |
| `display_icon` | string | false | | Display icon is a URL to an icon to display in the UI. |
| `display_name` | string | false | | Display name is shown in the UI to identify the auth config. |
| `id` | string | false | | ID is a unique identifier for the auth config. It defaults to `type` when not provided. |
| `mcp_tool_allow_regex` | string | false | | |
| `mcp_tool_deny_regex` | string | false | | |
| `mcp_url` | string | false | | |
| `no_refresh` | boolean | false | | |
| Name | Type | Required | Restrictions | Description |
|------------------------------------|-----------------|----------|--------------|-------------------------------------------------------------------------------------------------------------------|
| `app_install_url` | string | false | | |
| `app_installations_url` | string | false | | |
| `auth_url` | string | false | | |
| `client_id` | string | false | | |
| `code_challenge_methods_supported` | array of string | false | | Code challenge methods supported lists the PKCE code challenge methods The only one supported by Coder is "S256". |
| `device_code_url` | string | false | | |
| `device_flow` | boolean | false | | |
| `display_icon` | string | false | | Display icon is a URL to an icon to display in the UI. |
| `display_name` | string | false | | Display name is shown in the UI to identify the auth config. |
| `id` | string | false | | ID is a unique identifier for the auth config. It defaults to `type` when not provided. |
| `mcp_tool_allow_regex` | string | false | | |
| `mcp_tool_deny_regex` | string | false | | |
| `mcp_url` | string | false | | |
| `no_refresh` | boolean | false | | |
|`regex`|string|false||Regex allows API requesters to match an auth config by a string (e.g. coder.com) instead of by it's type.
Git clone makes use of this by parsing the URL from: 'Username for "https://github.com":' And sending it to the Coder server to match against the Regex.|
|`revoke_url`|string|false|||
@@ -14031,6 +14041,9 @@ None
"app_installations_url": "string",
"auth_url": "string",
"client_id": "string",
"code_challenge_methods_supported": [
"string"
],
"device_code_url": "string",
"device_flow": true,
"display_icon": "string",