Hey everyone, I’m looking to improve our security posture, and part of that means that we need to avoid using secret credentials whenever we can. Unfortunately the OIDC plugin required a client secret credential to hit the /userinfo endpoint, and I couldn’t set up my forum with it enabled. Fortun…

I think what you’re describing here is the OpenID Connect “Implicit Flow” , which works without any server->server communication, and therefore doesn’t need a shared secret. Instead, all information is transmitted via the HTTP redirects, and the ID token is cryptographically verified using the public…

Also worth noting that the OIDC “Implicit Flow” does increase the surface area for CSRF attacks and token exposure: [صورة] Implicit flow vs. Authorization code flow: Why implicit flow is dead? · Logto... Why is there an "Authorization code flow" in OAuth 2.0 when we already have the "Im…

Thank you for the detailed reply! I think it can still make sense for some situations. But it seems like the Authorization Code flow (Discourse’s default) with PKCE (optional in Discourse) is the most-recommended way to use OIDC. This is very interesting - I didn’t fully grasp PKCE until now. Ba…

Okay - this works with the following configuration: "DISCOURSE_OPENID_CONNECT_ENABLED": "true", "DISCOURSE_OPENID_CONNECT_DISCOVERY_DOCUMENT": "https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration", "DISCOURSE_OPENID_CONNECT_CLIENT_ID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx…

Thanks for this @justinm . I’ve merged the PR, and added a section to the docs: [صورة] Discourse OpenID Connect (OIDC) For identity providers which support secret-less authorization using the “Authorization Code Flow with Proof Key for Code Exchange” , PKCE should be enabled, and the client_secret …

إعادة هيكلة إضافة OpenID Connect

مطور

david (David Taylor) 16 يناير 2026، 1:29م 6

شكرًا لك على هذا @justinm. لقد دمجت طلب السحب (PR)، وأضفت قسمًا إلى الوثائق:

الموضوع		الردود	مرات العرض
Discourse OpenID Connect (OIDC) Plugin official , openid-connect , auth-plugins , included-in-core	46	49717	27 مايو 2026
OAuth connection of discourse Support	3	1327	16 سبتمبر 2020
Create a custom Discourse plugin Development	2	174	24 يونيو 2024
How is it possible to connect Discourse with two OIDC providers? SSO openid-connect	3	255	25 أبريل 2026
Discourse-azure-oauth2 -- version token support Support	4	1704	15 يناير 2019

إعادة هيكلة إضافة OpenID Connect

الموضوعات ذات الصلة