Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-124336

[OAuth OIDC] Add nonce support

    XMLWordPrintable

Details

    Description

      OpenIDConnect core specification defines an OPTIONAL 'nonce' request parameter.
      The purpose for the 'nonce' is to mitigate replay attacks; the returned "ID token" (JWT) contains the same "nonce".

      qtnetworkauth should add convenience support for this. Note that the QAbstractOAuth class does have a /protected/ function

      static QByteArray generateRandomString(quint8 length);

      which can very likely be used for this purpose.

      While the OpenIDConnect marks the parameters as optional, many OAuth providers mark it as REQUIRED (see eg.
      Facebook or Google).

      Attachments

        Issue Links

          clones

          Task - A task that needs to be done. QTBUG-124327 [OAuth] PKCE support

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Closed
          is cloned by

          Task - A task that needs to be done. QTBUG-124337 [OAuth] Improve nonce-generation

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Closed

          Task - A task that needs to be done. QTBUG-127839 [OAuth] Support QtWebEngine usage as the user-agent

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Closed
          For Gerrit Dashboard: QTBUG-124336
          # Subject Branch Project Status CR V
          590573,12 Add 'nonce' support for OAuth2 dev qt/qtnetworkauth Status: MERGED +2 0

          Activity

            People

              vuokko Juha Vuolle
              vuokko Juha Vuolle
              Vladimir Minenko Vladimir Minenko
              Alex Blasche Alex Blasche
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Gerrit Reviews

                  There are no open Gerrit changes