# Discourse OpenID Connect (OIDC)

**URL:** <https://meta.discourse.org/t/discourse-openid-connect-oidc/103632>\
**Category:** Plugin\
**Tags:** official, openid-connect, auth-plugins, included-in-core\
**Created:** [2018年十二月6日 16:08 UTC](https://meta.discourse.org/t/discourse-openid-connect-oidc/103632 "2018-12-06T16:08:20Z")\
**Posts on this page:** 1\
**Showing post:** 288

<div class="post-metadata">

**Author:** ![balazsorban44](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/balazsorban44/32/452637_2.png) [@balazsorban44](https://meta.discourse.org/u/balazsorban44)\
**Post date:** [2024年十月1日 14:59 UTC](https://meta.discourse.org/t/discourse-openid-connect-oidc/103632/288 "2024-10-01T14:59:19Z")

</div>

抱歉打扰，但有一个针对此的开放 PR，合并它以添加 PKCE 支持应该很容易。

@nbianca 我看到您是该存储库的最新提交者，您能看一下吗？🙏

> <https://github.com/discourse/discourse-openid-connect/pull/80>
>
> \### Enable PKCE Support
> 
> \#### Description
> This pull request enables support f…or PKCE (Proof Key for Code Exchange) to enhance the security of OpenID Connect.
> 
> \#### Changes
> \- Added \`openid\_connect\_use\_pkce\` configuration in \`config/settings.yml\`.
> \- Implemented PKCE generation and validation logic in \`lib/openid\_connect\_authenticator.rb\`, including:
> - \`generate\_code\_verifier\` method: Generates a random code verifier.
> - \`generate\_code\_challenge\` method: Generates a code challenge based on the SHA256 algorithm.
> \- Enabled support for \`openid\_connect\_use\_pkce\` configuration in \`plugin.rb\`.
> 
> \#### Testing
> \- Tested locally to ensure PKCE works as expected.
> \- Successfully implemented in the production environment's identity server SSO.
> 
> \#### Additional Notes
> These changes will enhance the security of OpenID Connect, especially in public client scenarios.

---

_[View the full topic](https://meta.discourse.org/t/discourse-openid-connect-oidc/103632)._