feat: add codeVerifierTTL to the OIDC SecurityPolicy - #9645
Open
zhaohuabing wants to merge 1 commit into
Open
Conversation
✅ Deploy Preview for cerulean-figolla-1f9435 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
zhaohuabing
force-pushed
the
feat-oidc-code-verifier-ttl
branch
3 times, most recently
from
August 3, 2026 08:03
fa0d5ae to
2751b6c
Compare
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #9645 +/- ##
=======================================
Coverage 76.07% 76.07%
=======================================
Files 260 260
Lines 43446 43453 +7
=======================================
+ Hits 33051 33057 +6
- Misses 8191 8192 +1
Partials 2204 2204 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
csrfTokenTTL already bounds the lifetime of the nonce cookie Envoy sets when it starts an authorization flow, but there was no equivalent for the PKCE code verifier cookie, which stayed pinned at the oauth2 filter's 600s default. Both cookies are only consumed on the callback endpoint, so a flow that is started but never completed leaves them in the browser until they expire. Exposing code_verifier_token_expires_in lets an operator bound that window for the code verifier the same way csrfTokenTTL already does for the nonce. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
zhaohuabing
force-pushed
the
feat-oidc-code-verifier-ttl
branch
from
August 4, 2026 02:43
2751b6c to
498f2b9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
spec.oidc.codeVerifierTTLto SecurityPolicy, mapping to the oauth2 filter'scode_verifier_token_expires_in.csrfTokenTTLalready bounds the lifetime of the nonce cookie Envoy sets when it starts an authorization flow, but there was no equivalent for the PKCE code verifier cookie, which stayed pinned at Envoy's 600s default.Both cookies are only consumed on the callback endpoint, so a flow that is started but never completed leaves them in the browser until they expire. This lets an operator bound that window for the code verifier the same way
csrfTokenTTLalready does for the nonce.Independent of #9644, which fixes the same underlying problem from the other direction and is deliberately kept API-free so it can be cherry-picked to release branches.