# Discourse OpenID Connect (OIDC)

**URL:** <https://meta.discourse.org/t/discourse-openid-connect-oidc/103632>\
**Category:** Plugin\
**Tags:** official, openid-connect, auth-plugins, included-in-core\
**Created:** [December 6, 2018, 4:08pm UTC](https://meta.discourse.org/t/discourse-openid-connect-oidc/103632 "2018-12-06T16:08:20Z")\
**Posts on this page:** 1\
**Showing post:** 292

<div class="post-metadata">

**Author:** ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)\
**Post date:** [October 3, 2024, 12:30pm UTC](https://meta.discourse.org/t/discourse-openid-connect-oidc/103632/292 "2024-10-03T12:30:21Z")

</div>

Hi @balazsorban44, thanks for the reminder on this. I’ve done a first pass of reviewing the PR. If the author doesn’t have time to work on those things, then it’s likely something we can take on. I agree having PKCE support would be nice.

However, it’s worth noting: I don’t think Discourse is vulnerable to the “authorization code interception” attacks which PKCE protects against. Discourse authentication always happens in-browser over `https`, and does not use OS-level custom URL schemes which can be intercepted by other apps.

But of course, there is no harm in adding the extra layer of security 👍

---

_[View the full topic](https://meta.discourse.org/t/discourse-openid-connect-oidc/103632)._