docs: align state/nonce/PKCE format expectations with provider validation

Document provider-side strict validation for OAuth authorization request parameters so integrations generate URL-safe, spec-conformant state/nonce/PKCE values.
2026-02-26 12:07:18 +00:00
parent f51997016d
commit cdef7da4b9
1 changed files with 1 additions and 0 deletions
@@ -152,6 +152,7 @@ Provider login/authorization steps can also fail with `access_denied` when accou
 - Rotate client secrets for confidential clients.
 - Do not transport secrets or tokens in URL query parameters; keep them in server-side session or secure storage only.
 - Add a unique `nonce` to each OIDC authorisation request.
+- Keep `state`, `nonce`, and PKCE values within standard URL-safe formats/lengths; malformed values can be rejected by provider validation.
 - Validate `state` on every callback request.
 - Use secure session cookies (`Secure`, `HttpOnly`, `SameSite=Lax` or stricter).
 - HTTPS URLs are enforced by default in `Config::fromArray()`.