Change Details

**Feature summary** (what you would like to be able to do and where): Add configuration option "codeChallengeMethod" for PKCE support. **Use case(s)** (list the steps that you performed to discover that problem, and describe the actual underlying problem which you want to solve. Do not describe only a solution): Many OIDC providers support the PKCE flow (Proof Key for Code Exchange) https://oauth.net/2/pkce/ which increases security in OIDC authentication flows. Some even mandate it. The OpenID Connect extension should support PKCE. **Benefits** (why should this be implemented?): Increased security for OIDC authentication Support OIDC providers with mandatory PKCE A patch has already been submitted in Gerrit: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/OpenIDConnect/+/1035869

**Feature summary** (what you would like to be able to do and where): Add configuration option "codeChallengeMethod" for PKCE support. Can be set to "S256". **Use case(s)** (list the steps that you performed to discover that problem, and describe the actual underlying problem which you want to solve. Do not describe only a solution): Many OIDC providers support the PKCE flow (Proof Key for Code Exchange) https://oauth.net/2/pkce/ which increases security in OIDC authentication flows. Some even mandate it. The OpenID Connect extension should support PKCE. **Benefits** (why should this be implemented?): Increased security for OIDC authentication Support OIDC providers with mandatory PKCE A patch has already been submitted in Gerrit: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/OpenIDConnect/+/1035869

**Feature summary** (what you would like to be able to do and where): Add configuration option "codeChallengeMethod" for PKCE support. Can be set to "S256". **Use case(s)** (list the steps that you performed to discover that problem, and describe the actual underlying problem which you want to solve. Do not describe only a solution): Many OIDC providers support the PKCE flow (Proof Key for Code Exchange) https://oauth.net/2/pkce/ which increases security in OIDC authentication flows. Some even mandate it. The OpenID Connect extension should support PKCE. **Benefits** (why should this be implemented?): Increased security for OIDC authentication Support OIDC providers with mandatory PKCE A patch has already been submitted in Gerrit: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/OpenIDConnect/+/1035869