From cdef7da4b99474ce43a4348cca61f65923a4c7bf Mon Sep 17 00:00:00 2001 From: Andy Dixon Date: Thu, 26 Feb 2026 12:07:18 +0000 Subject: [PATCH] docs: align state/nonce/PKCE format expectations with provider validation Document provider-side strict validation for OAuth authorization request parameters so integrations generate URL-safe, spec-conformant state/nonce/PKCE values. --- docs/INTEGRATION_GUIDE.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/INTEGRATION_GUIDE.md b/docs/INTEGRATION_GUIDE.md index 1931b01..a448be0 100644 --- a/docs/INTEGRATION_GUIDE.md +++ b/docs/INTEGRATION_GUIDE.md @@ -152,6 +152,7 @@ Provider login/authorization steps can also fail with `access_denied` when accou - Rotate client secrets for confidential clients. - Do not transport secrets or tokens in URL query parameters; keep them in server-side session or secure storage only. - Add a unique `nonce` to each OIDC authorisation request. +- Keep `state`, `nonce`, and PKCE values within standard URL-safe formats/lengths; malformed values can be rejected by provider validation. - Validate `state` on every callback request. - Use secure session cookies (`Secure`, `HttpOnly`, `SameSite=Lax` or stricter). - HTTPS URLs are enforced by default in `Config::fromArray()`.