Updated to enforce nonce in example and documentaion

README.md

@@ -79,7 +79,7 @@ $client = new AuthClient($config);
 // Step 1: redirect user to provider
 $auth = $client->buildAuthorisationUrl([
     'extra' => [
-        // Some providers require nonce for OIDC requests.
+        // Include nonce in the authorisation request for OIDC.
         'nonce' => rtrim(strtr(base64_encode(random_bytes(32)), '+/', '-_'), '='),
     ],
 ]);
@@ -87,6 +87,8 @@ header('Location: ' . $auth['url']);
 exit;
 ```
 
+The generated authorisation request URL will include `nonce=...` alongside `state`, `scope`, and the PKCE parameters.
+
 For callback handling, see `docs/INTEGRATION_GUIDE.md`.
 For provider-side threat/invariant assumptions, see `docs/SECURITY_MODEL.md`.
 

docs/INTEGRATION_GUIDE.md

@@ -27,7 +27,7 @@ $client = new AuthClient(Config::fromArray([
 if (!isset($_SESSION['user'])) {
     $auth = $client->buildAuthorisationUrl([
         'extra' => [
-            // Some providers require nonce for OIDC requests.
+            // Include nonce in the authorisation request for OIDC.
             'nonce' => rtrim(strtr(base64_encode(random_bytes(32)), '+/', '-_'), '='),
         ],
     ]);
@@ -41,6 +41,8 @@ if (!isset($_SESSION['user'])) {
 echo 'Already signed in.';
 ```
 
+The resulting redirect request includes `nonce=...` in the provider authorisation URL, together with `state`, `code_challenge`, and the rest of the OAuth/OIDC query parameters.
+
 ## 2. Handle callback
 
 ```php

public_html/index.php

@@ -39,7 +39,11 @@ if (isset($_GET['logout'])) {
 }
 
 if (!isset($_SESSION['user'])) {
-    $authData = $auth->getAuthorizationUrl();
+    $authData = $auth->getAuthorizationUrl([
+        'extra' => [
+            'nonce' => rtrim(strtr(base64_encode(random_bytes(32)), '+/', '-_'), '='),
+        ],
+    ]);
     header('Location: ' . $authData['url']);
     exit;
 }