feat: add codeVerifierTTL to the OIDC SecurityPolicy

api/v1alpha1/oidc_types.go

@@ -156,6 +156,24 @@ type OIDC struct {
 	// +optional
 	CSRFTokenTTL *gwapiv1.Duration `json:"csrfTokenTTL,omitempty"`
 
+	// CodeVerifierTTL defines how long the PKCE code verifier generated during the OAuth2
+	// authorization flow remains valid.
+	//
+	// This duration determines the lifetime of the code verifier cookie, which is exchanged
+	// for the access token when the provider redirects back to the callback endpoint.
+	//
+	// Both this cookie and the CSRF cookie are only consumed on the callback endpoint, so an
+	// authorization flow that is started but never completed leaves them behind until they
+	// expire. Lowering this value along with csrfTokenTTL bounds how many such cookies a
+	// browser can accumulate. It must stay long enough for a user to complete the login,
+	// including any multi-factor prompt: once it elapses the browser drops the cookie and
+	// the callback fails.
+	//
+	// If omitted, Envoy Gateway defaults the code verifier expiration to 10 minutes.
+	//
+	// +optional
+	CodeVerifierTTL *gwapiv1.Duration `json:"codeVerifierTTL,omitempty"`
+
 	// Disable token encryption. When set to true, both the access token and the ID token will be stored in plain text.
 	// This option should only be used in secure environments where token encryption is not required.
 	// Default is false (tokens are encrypted).

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml

@@ -5782,6 +5782,24 @@ spec:
                     required:
                     - name
                     type: object
+                  codeVerifierTTL:
+                    description: |-
+                      CodeVerifierTTL defines how long the PKCE code verifier generated during the OAuth2
+                      authorization flow remains valid.
+
+                      This duration determines the lifetime of the code verifier cookie, which is exchanged
+                      for the access token when the provider redirects back to the callback endpoint.
+
+                      Both this cookie and the CSRF cookie are only consumed on the callback endpoint, so an
+                      authorization flow that is started but never completed leaves them behind until they
+                      expire. Lowering this value along with csrfTokenTTL bounds how many such cookies a
+                      browser can accumulate. It must stay long enough for a user to complete the login,
+                      including any multi-factor prompt: once it elapses the browser drops the cookie and
+                      the callback fails.
+
+                      If omitted, Envoy Gateway defaults the code verifier expiration to 10 minutes.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                    type: string
                   cookieConfig:
                     description: |-
                       CookieConfigs allows setting the SameSite attribute for OIDC cookies.

charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml

@@ -5781,6 +5781,24 @@ spec:
                     required:
                     - name
                     type: object
+                  codeVerifierTTL:
+                    description: |-
+                      CodeVerifierTTL defines how long the PKCE code verifier generated during the OAuth2
+                      authorization flow remains valid.
+
+                      This duration determines the lifetime of the code verifier cookie, which is exchanged
+                      for the access token when the provider redirects back to the callback endpoint.
+
+                      Both this cookie and the CSRF cookie are only consumed on the callback endpoint, so an
+                      authorization flow that is started but never completed leaves them behind until they
+                      expire. Lowering this value along with csrfTokenTTL bounds how many such cookies a
+                      browser can accumulate. It must stay long enough for a user to complete the login,
+                      including any multi-factor prompt: once it elapses the browser drops the cookie and
+                      the callback fails.
+
+                      If omitted, Envoy Gateway defaults the code verifier expiration to 10 minutes.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                    type: string
                   cookieConfig:
                     description: |-
                       CookieConfigs allows setting the SameSite attribute for OIDC cookies.

internal/gatewayapi/securitypolicy.go

@@ -2202,6 +2202,14 @@ func (t *Translator) buildOIDC(
 		}
 	}
 
+	if oidc.CodeVerifierTTL != nil {
+		if d, err := time.ParseDuration(string(*oidc.CodeVerifierTTL)); err == nil {
+			irOIDC.CodeVerifierTTL = ir.MetaV1DurationPtr(d)
+		} else {
+			return nil, fmt.Errorf("invalid codeVerifierTTL: %w", err)
+		}
+	}
+
 	return irOIDC, nil
 }
 

internal/gatewayapi/testdata/securitypolicy-with-oidc.in.yaml

@@ -126,6 +126,7 @@ securityPolicies:
       refreshToken: true
       defaultRefreshTokenTTL: 24h
       csrfTokenTTL: 35m
+      codeVerifierTTL: 2m
 - apiVersion: gateway.envoyproxy.io/v1alpha1
   kind: SecurityPolicy
   metadata:

internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml

@@ -281,6 +281,7 @@ securityPolicies:
       clientID: client1.apps.googleusercontent.com
       clientSecret:
         name: client1-secret
+      codeVerifierTTL: 2m
       csrfTokenTTL: 35m
       defaultRefreshTokenTTL: 24h
       defaultTokenTTL: 30m
@@ -451,6 +452,7 @@ xdsIR:
           oidc:
             clientID: client1.apps.googleusercontent.com
             clientSecret: '[redacted]'
+            codeVerifierTTL: 2m0s
             cookieSuffix: b0a1b740
             csrfTokenTTL: 35m0s
             defaultRefreshTokenTTL: 24h0m0s

internal/ir/xds.go

@@ -1460,6 +1460,9 @@ type OIDC struct {
 	// CSRFTokenTTL configures the lifetime of the csrf token Envoy stores in the cookie.
 	CSRFTokenTTL *metav1.Duration `json:"csrfTokenTTL,omitempty"`
 
+	// CodeVerifierTTL configures the lifetime of the PKCE code verifier Envoy stores in the cookie.
+	CodeVerifierTTL *metav1.Duration `json:"codeVerifierTTL,omitempty"`
+
 	// CookieSuffix will be added to the name of the cookies set by the oauth filter.
 	// Adding a suffix avoids multiple oauth filters from overwriting each other's cookies.
 	// These cookies are set by the oauth filter, including: AccessToken,

internal/xds/translator/oidc.go

@@ -229,6 +229,10 @@ func oauth2Config(securityFeatures *ir.SecurityFeatures) (*oauth2v3.OAuth2PerRou
 		oauth2.Config.CsrfTokenExpiresIn = durationpb.New(oidc.CSRFTokenTTL.Duration)
 	}
 
+	if oidc.CodeVerifierTTL != nil {
+		oauth2.Config.CodeVerifierTokenExpiresIn = durationpb.New(oidc.CodeVerifierTTL.Duration)
+	}
+
 	if oidc.ForwardIDTokenHeader != nil {
 		oauth2.Config.ForwardIdToken = &oauth2v3.OAuth2TokenForwarding{
 			Header: *oidc.ForwardIDTokenHeader,

internal/xds/translator/testdata/in/xds-ir/oidc.yaml

@@ -46,6 +46,7 @@ http:
         refreshToken: true
         defaultRefreshTokenTTL: 48h
         csrfTokenTTL: 35m
+        codeVerifierTTL: 2m
   - name: "second-route"
     hostname: "*"
     pathMatch:

internal/xds/translator/testdata/out/xds-ir/oidc.routes.yaml

@@ -22,6 +22,7 @@
             - profile
             authType: BASIC_AUTH
             authorizationEndpoint: https://oauth.foo.com/oauth2/v2/auth
+            codeVerifierTokenExpiresIn: 120s
             credentials:
               clientId: client.oauth.foo.com
               cookieNames:

release-notes/current/new_features/9645-oidc-code-verifier-ttl.md

@@ -0,0 +1,3 @@
+Added `spec.oidc.codeVerifierTTL` to SecurityPolicy to configure how long the PKCE code verifier cookie
+generated during the OAuth2 authorization flow remains valid. Alongside `csrfTokenTTL`, this bounds how
+long the cookies of an abandoned authorization flow live in the browser. Defaults to 10 minutes.

site/content/en/latest/api/extension_types.md

@@ -4404,6 +4404,7 @@ _Appears in:_
 | `refreshToken` | _boolean_ |  false  | true | RefreshToken indicates whether the Envoy should automatically refresh the<br />id token and access token when they expire.<br />When set to true, the Envoy will use the refresh token to get a new id token<br />and access token when they expire.<br />If not specified, defaults to true. |
 | `defaultRefreshTokenTTL` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ |  false  |  | DefaultRefreshTokenTTL is the default lifetime of the refresh token.<br />This field is only used when the exp (expiration time) claim is omitted in<br />the refresh token or the refresh token is not JWT.<br />If not specified, defaults to 604800s (one week).<br />Note: this field is only applicable when the "refreshToken" field is set to true. |
 | `csrfTokenTTL` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ |  false  |  | CSRFTokenTTL defines how long the CSRF token generated during the OAuth2 authorization flow remains valid.<br />This duration determines the lifetime of the CSRF cookie, which is validated against the CSRF token<br />in the "state" parameter when the provider redirects back to the callback endpoint.<br />If omitted, Envoy Gateway defaults the token expiration to 10 minutes. |
+| `codeVerifierTTL` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ |  false  |  | CodeVerifierTTL defines how long the PKCE code verifier generated during the OAuth2<br />authorization flow remains valid.<br />This duration determines the lifetime of the code verifier cookie, which is exchanged<br />for the access token when the provider redirects back to the callback endpoint.<br />Both this cookie and the CSRF cookie are only consumed on the callback endpoint, so an<br />authorization flow that is started but never completed leaves them behind until they<br />expire. Lowering this value along with csrfTokenTTL bounds how many such cookies a<br />browser can accumulate. It must stay long enough for a user to complete the login,<br />including any multi-factor prompt: once it elapses the browser drops the cookie and<br />the callback fails.<br />If omitted, Envoy Gateway defaults the code verifier expiration to 10 minutes. |
 | `disableTokenEncryption` | _boolean_ |  false  |  | Disable token encryption. When set to true, both the access token and the ID token will be stored in plain text.<br />This option should only be used in secure environments where token encryption is not required.<br />Default is false (tokens are encrypted). |
 | `passThroughAuthHeader` | _boolean_ |  false  |  | Skips OIDC authentication when the request contains a header that will be extracted by the JWT filter. Unless<br />explicitly stated otherwise in the extractFrom field, this will be the "Authorization: Bearer ..." header.<br />The passThroughAuthHeader option is typically used for non-browser clients that may not be able to handle OIDC<br />redirects and wish to directly supply a token instead.<br />If not specified, defaults to false. |
 

test/helm/gateway-crds-helm/all.out.yaml

@@ -58674,6 +58674,24 @@ spec:
                     required:
                     - name
                     type: object
+                  codeVerifierTTL:
+                    description: |-
+                      CodeVerifierTTL defines how long the PKCE code verifier generated during the OAuth2
+                      authorization flow remains valid.
+
+                      This duration determines the lifetime of the code verifier cookie, which is exchanged
+                      for the access token when the provider redirects back to the callback endpoint.
+
+                      Both this cookie and the CSRF cookie are only consumed on the callback endpoint, so an
+                      authorization flow that is started but never completed leaves them behind until they
+                      expire. Lowering this value along with csrfTokenTTL bounds how many such cookies a
+                      browser can accumulate. It must stay long enough for a user to complete the login,
+                      including any multi-factor prompt: once it elapses the browser drops the cookie and
+                      the callback fails.
+
+                      If omitted, Envoy Gateway defaults the code verifier expiration to 10 minutes.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                    type: string
                   cookieConfig:
                     description: |-
                       CookieConfigs allows setting the SameSite attribute for OIDC cookies.

test/helm/gateway-crds-helm/e2e.out.yaml

@@ -34612,6 +34612,24 @@ spec:
                     required:
                     - name
                     type: object
+                  codeVerifierTTL:
+                    description: |-
+                      CodeVerifierTTL defines how long the PKCE code verifier generated during the OAuth2
+                      authorization flow remains valid.
+
+                      This duration determines the lifetime of the code verifier cookie, which is exchanged
+                      for the access token when the provider redirects back to the callback endpoint.
+
+                      Both this cookie and the CSRF cookie are only consumed on the callback endpoint, so an
+                      authorization flow that is started but never completed leaves them behind until they
+                      expire. Lowering this value along with csrfTokenTTL bounds how many such cookies a
+                      browser can accumulate. It must stay long enough for a user to complete the login,
+                      including any multi-factor prompt: once it elapses the browser drops the cookie and
+                      the callback fails.
+
+                      If omitted, Envoy Gateway defaults the code verifier expiration to 10 minutes.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                    type: string
                   cookieConfig:
                     description: |-
                       CookieConfigs allows setting the SameSite attribute for OIDC cookies.

test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml

@@ -34612,6 +34612,24 @@ spec:
                     required:
                     - name
                     type: object
+                  codeVerifierTTL:
+                    description: |-
+                      CodeVerifierTTL defines how long the PKCE code verifier generated during the OAuth2
+                      authorization flow remains valid.
+
+                      This duration determines the lifetime of the code verifier cookie, which is exchanged
+                      for the access token when the provider redirects back to the callback endpoint.
+
+                      Both this cookie and the CSRF cookie are only consumed on the callback endpoint, so an
+                      authorization flow that is started but never completed leaves them behind until they
+                      expire. Lowering this value along with csrfTokenTTL bounds how many such cookies a
+                      browser can accumulate. It must stay long enough for a user to complete the login,
+                      including any multi-factor prompt: once it elapses the browser drops the cookie and
+                      the callback fails.
+
+                      If omitted, Envoy Gateway defaults the code verifier expiration to 10 minutes.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                    type: string
                   cookieConfig:
                     description: |-
                       CookieConfigs allows setting the SameSite attribute for OIDC cookies.