andy/blackwall-auth-sdk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Updated to enforce nonce in example and documentaion

Browse Source
This commit is contained in:
Andy Dixon
2026-03-10 09:50:34 +00:00
parent 6b67bf574d
commit 986dc95646
3 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+3 -1
View File
@@ -79,7 +79,7 @@ $client = new AuthClient($config);
// Step 1: redirect user to provider // Step 1: redirect user to provider
$auth = $client->buildAuthorisationUrl([ $auth = $client->buildAuthorisationUrl([
'extra' => [ 'extra' => [
// Some providers require nonce for OIDC requests. // Include nonce in the authorisation request for OIDC.
'nonce' => rtrim(strtr(base64_encode(random_bytes(32)), '+/', '-_'), '='), 'nonce' => rtrim(strtr(base64_encode(random_bytes(32)), '+/', '-_'), '='),
], ],
]); ]);
@@ -87,6 +87,8 @@ header('Location: ' . $auth['url']);
exit; exit;
``` ```
The generated authorisation request URL will include `nonce=...` alongside `state`, `scope`, and the PKCE parameters.
For callback handling, see `docs/INTEGRATION_GUIDE.md`. For callback handling, see `docs/INTEGRATION_GUIDE.md`.
For provider-side threat/invariant assumptions, see `docs/SECURITY_MODEL.md`. For provider-side threat/invariant assumptions, see `docs/SECURITY_MODEL.md`.
docs/INTEGRATION_GUIDE.md
+3 -1
View File
@@ -27,7 +27,7 @@ $client = new AuthClient(Config::fromArray([
if (!isset($_SESSION['user'])) { if (!isset($_SESSION['user'])) {
$auth = $client->buildAuthorisationUrl([ $auth = $client->buildAuthorisationUrl([
'extra' => [ 'extra' => [
// Some providers require nonce for OIDC requests. // Include nonce in the authorisation request for OIDC.
'nonce' => rtrim(strtr(base64_encode(random_bytes(32)), '+/', '-_'), '='), 'nonce' => rtrim(strtr(base64_encode(random_bytes(32)), '+/', '-_'), '='),
], ],
]); ]);
@@ -41,6 +41,8 @@ if (!isset($_SESSION['user'])) {
echo 'Already signed in.'; echo 'Already signed in.';
``` ```
The resulting redirect request includes `nonce=...` in the provider authorisation URL, together with `state`, `code_challenge`, and the rest of the OAuth/OIDC query parameters.
## 2. Handle callback ## 2. Handle callback
```php ```php
public_html/index.php
+5 -1
View File
@@ -39,7 +39,11 @@ if (isset($_GET['logout'])) {
} }
if (!isset($_SESSION['user'])) { if (!isset($_SESSION['user'])) {
$authData = $auth->getAuthorizationUrl(); $authData = $auth->getAuthorizationUrl([
'extra' => [
'nonce' => rtrim(strtr(base64_encode(random_bytes(32)), '+/', '-_'), '='),
],
]);
header('Location: ' . $authData['url']); header('Location: ' . $authData['url']);
exit; exit;
} }