Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-124327

[OAuth] PKCE support

XMLWordPrintable

      Proof Key for Code Exchange (PKCE) as defined in RFC 7636 is an important security measure
      in particular for public native client applications, such as Qt applications. The use of PKCE mitigates the risk of authorization code interception attack,
      where a malicious application steals the authorization code and uses it to gain an access token.

      qtneworkauth OAuth2 should implement out-of-the-box convenience support for this. This will likely mean:

      • public API to toggle the behaviour. Likely an Enum: "None", "Plain" "S256"
      • calculation and storing of code_verifier and code_challenge
      • including these values in authorization message as well as when acquiring the access token

      The S256 should be made the default choice, and PKCE should be used by default:

      • Any server that doesn't support PKCE at all, should just ignore the parameters as per RFC
      • Any server that does support PKCE, must support S256

        For Gerrit Dashboard: QTBUG-124327
        # Subject Branch Project Status CR V

            vuokko Juha Vuolle
            vuokko Juha Vuolle
            Vladimir Minenko Vladimir Minenko
            Alex Blasche Alex Blasche
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved:

                There are no open Gerrit changes