Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-124327

[OAuth] PKCE support

    XMLWordPrintable

Details

    Description

      Proof Key for Code Exchange (PKCE) as defined in RFC 7636 is an important security measure
      in particular for public native client applications, such as Qt applications. The use of PKCE mitigates the risk of authorization code interception attack,
      where a malicious application steals the authorization code and uses it to gain an access token.

      qtneworkauth OAuth2 should implement out-of-the-box convenience support for this. This will likely mean:

      • public API to toggle the behaviour. Likely an Enum: "None", "Plain" "S256"
      • calculation and storing of code_verifier and code_challenge
      • including these values in authorization message as well as when acquiring the access token

      The S256 should be made the default choice, and PKCE should be used by default:

      • Any server that doesn't support PKCE at all, should just ignore the parameters as per RFC
      • Any server that does support PKCE, must support S256

      Attachments

        Issue Links

          For Gerrit Dashboard: QTBUG-124327
          # Subject Branch Project Status CR V

          Activity

            People

              vuokko Juha Vuolle
              vuokko Juha Vuolle
              Vladimir Minenko Vladimir Minenko
              Alex Blasche Alex Blasche
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Gerrit Reviews

                  There are no open Gerrit changes