diff options
| author | Juha Vuolle <juha.vuolle@qt.io> | 2024-09-12 15:00:15 +0300 |
|---|---|---|
| committer | Juha Vuolle <juha.vuolle@qt.io> | 2024-10-08 10:19:19 +0300 |
| commit | 62feb2e829ba0274fcb6ad36fd9a8aac9b8cb2cc (patch) | |
| tree | 0e996c354cf31c0b02974c07d1df433dffcd4078 /src/oauth/qoauth2authorizationcodeflow.cpp | |
| parent | 9037b1fde7b66ee1fe1d0e3feea62d0e26ca119a (diff) | |
Add 'nonce' support for OAuth2
OpenID Connect token acquisition is a thin layer on
top of OAuth2 flows. In practice this often requires
using 'nonce' parameter, which is used to associate
authorization (authentication) with the supplied ID
token. Some vendors either refuse or require additional
security credentials if 'nonce' is omitted with
OIDC flows.
This commit introduces two facilities to make usage
of 'nonce' easy:
- Mode to control whether or not the nonce should be
included
- Property for reading (and optionally setting) the
nonce
The default nonce mode is 'automatic', meaning that
nonce is only used if required by OIDC flow.
[ChangeLog][QAbstractOAuth2] Added 'nonce' property and
'NonceMode' enum for using nonce in the flows.
Fixes: QTBUG-124336
Change-Id: I21a9a344a1bd1d8f440677f3c9335ce4df089a3f
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Diffstat (limited to 'src/oauth/qoauth2authorizationcodeflow.cpp')
| -rw-r--r-- | src/oauth/qoauth2authorizationcodeflow.cpp | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/oauth/qoauth2authorizationcodeflow.cpp b/src/oauth/qoauth2authorizationcodeflow.cpp index f86bd58..c738d2a 100644 --- a/src/oauth/qoauth2authorizationcodeflow.cpp +++ b/src/oauth/qoauth2authorizationcodeflow.cpp @@ -544,6 +544,11 @@ QUrl QOAuth2AuthorizationCodeFlow::buildAuthenticateUrl(const QMultiMap<QString, p.insert(Key::codeChallengeMethod, d->pkceMethod == PkceMethod::Plain ? u"plain"_s : u"S256"_s); } + if (d->authorizationShouldIncludeNonce()) { + if (d->nonce.isEmpty()) + setNonce(QAbstractOAuth2Private::generateNonce()); + p.insert(Key::nonce, d->nonce); + } if (d->modifyParametersFunction) d->modifyParametersFunction(Stage::RequestingAuthorization, &p); url.setQuery(d->createQuery(p)); |