Updated to enforce nonce in example and documentaion

2026-03-10 09:50:34 +00:00
parent 6b67bf574d
commit 986dc95646
3 changed files with 11 additions and 3 deletions
@@ -39,7 +39,11 @@ if (isset($_GET['logout'])) {
 }

 if (!isset($_SESSION['user'])) {
-    $authData = $auth->getAuthorizationUrl();
+    $authData = $auth->getAuthorizationUrl([
+        'extra' => [
+            'nonce' => rtrim(strtr(base64_encode(random_bytes(32)), '+/', '-_'), '='),
+        ],
+    ]);
    header('Location: ' . $authData['url']);
    exit;
 }