[lambdalisue]

Summary

• Add automatic PKCE (S256) support for OIDC Authorization Code flow
• Remove clientSecret parameter (breaking change)
• Fix OIDC spec compliance by adding client_id to Authorization Request
• Update documentation to recommend issuer-based Discovery

Why

The OIDC HTTP client is designed for testing scenarios where it simulates end-user login flows. Supporting clientSecret was unnecessary since:

1. Public Client Use Case: This client targets Public Clients (SPAs, Native Apps) where client secrets cannot be securely stored
2. Testing Focus: Test scenarios don't require confidential client authentication
3. Security Best Practice: Modern OAuth 2.0 Security BCP mandates PKCE for Public Clients instead of relying on client secrets

PKCE (RFC 7636) is now automatically enabled using the S256 method, providing protection against authorization code interception attacks without requiring shared secrets.

The missing client_id in Authorization Request was also a spec compliance bug that prevented proper operation with strict OIDC providers.

Test Plan

• All existing unit tests pass
• All existing integration tests pass with PKCE enabled
• Verified PKCE flow works correctly with echo-http test server
• Documentation examples type-check successfully

[Copilot]

Pull request overview

This pull request enhances the OIDC HTTP client by adding PKCE (Proof Key for Code Exchange) support for the Authorization Code flow, making it more suitable for Public Clients (SPAs, Native Apps) while removing the unnecessary clientSecret parameter. The changes improve OIDC spec compliance by including client_id in authorization requests and update documentation to recommend issuer-based Discovery over manual endpoint configuration.

Key Changes:

• Automatic PKCE (S256 method) support added to protect against authorization code interception attacks
• Removed clientSecret parameter from OidcClientConfig interface (breaking change)
• Fixed spec compliance by adding client_id parameter to authorization requests

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The base64url encoding implementation using btoa(String.fromCharCode(...array)) may not correctly handle byte values greater than 127 in all JavaScript environments. While this might work in Deno's runtime, it could cause issues with certain random byte sequences.

Consider using a more robust approach that properly handles all byte values, such as iterating through the array and building the string character by character, or using a dedicated base64url encoding function.

[Copilot]

The base64url encoding implementation using btoa(String.fromCharCode(...new Uint8Array(hash))) may not correctly handle byte values greater than 127 in all JavaScript environments. While this might work in Deno's runtime, it could cause issues with certain hash output byte sequences.

Consider using a more robust approach that properly handles all byte values, such as iterating through the array and building the string character by character, or using a dedicated base64url encoding function.

[Copilot]

The newly added PKCE functionality is not covered by unit tests. The existing tests don't verify that:

1. code_challenge and code_challenge_method parameters are included in the authorization request
2. code_verifier parameter is included in the token exchange request
3. The code challenge correctly corresponds to the code verifier (S256 method)

Consider adding test assertions to verify these PKCE parameters are present in the requests.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!