feat: added simple PKCE and state checks utils, used PKCE and state checks in auth0 by Azurency · Pull Request #12 · atinux/nuxt-auth-utils

Azurency · 2023-11-10T21:49:39Z

I don't if that's something that something in the scope of a "Minimalist Authentication module" but I added simple PKCE and state checks in the auth0 provider for extra security.

The crypto methods and check logic could easily be extracted and reused in other oauth provider. I think that Google and Spotify accept the PKCE flow and Google and Twitch both accept a state check.

justserdar · 2023-11-11T16:49:50Z

The other providers could definitly benefit from a universal util that allows state checks and/or a pkce check.
If we can get this into like a importable util, i'd happily add it to the Discord and LinkedIn provider too for extra security.

sifferhans · 2023-11-12T12:40:48Z

You should probably use uncrypto instead of crypto here, as crypto might not be available in all server runtimes 😁

atinux · 2023-11-12T22:27:00Z

I would indeed leverage https://github.com/unjs/uncrypto

Also here we use randomUUID to create a random string: https://github.com/nuxt/nuxters/blob/d77b0e92092c39710aeb36d604d85b886bdc87b7/server/routes/connect/%5Bprovider%5D.get.ts#L12

Azurency · 2023-11-13T17:46:52Z

Tanks for the feedback 👍, I updated the checks to use uncrypto.

I also moved the logic in a separate util file so that other providers can simply call

const authParam = await checks.create(event, config.checks)

to get extra query param to be passed in the authorization request and

const checkResult = await checks.use(event, config.checks)

to verify the checks and get back the code_verifier if applicable.

maximilianmikus · 2023-11-29T08:46:40Z

src/runtime/server/utils/security.ts

+    if (checks?.includes('pkce')) {
+      const pkceVerifier = generateCodeVerifier()
+      const pkceChallenge = await pkceCodeChallenge(pkceVerifier)
+      console.log('pkceVerifier', pkceVerifier)


console.log leftover

maximilianmikus · 2023-11-29T09:18:46Z

src/runtime/server/utils/security.ts

+      console.log('pkceChallenge', pkceChallenge)
+      res['code_challenge'] = pkceChallenge
+      res['code_challenge_method'] = 'S256'
+      setCookie(event, 'nuxt-auth-util-verifier', pkceVerifier, { maxAge: 60 * 15, secure: true, httpOnly: true, sameSite: 'lax' })


I think the cookie settings should configurable or reuse the cookie settings from the module

I didn't reuse the cookie settings because they were under the session key, I don't know if it would be confusing to reuse that or not. But I agree that a shared cookie config somewhere would be nice.

I agree it would be a bit confusing. Maybe an optional config for pkce cookie?

I added a cookie setting (runtimeConfig), under nuxtAuthConfig.security.cookie

maximilianmikus · 2023-11-29T10:19:28Z

I would like to build upon this PR and add a generic OIDC provider. I already started but these utils would be super helpful for supporting pkce flow.

maximilianmikus · 2023-11-30T10:07:52Z

src/runtime/server/utils/security.ts

+        if (!state || !stateInCookie) {
+          const error = createError({
+            statusCode: 401,
+            message: 'Auth0 login failed: state is missing'


This message is still specific to Auth0

Good catch, I updated this

maximilianmikus · 2023-11-30T10:08:09Z

src/runtime/server/utils/security.ts

+        if (state !== stateInCookie) {
+          const error = createError({
+            statusCode: 401,
+            message: 'Auth0 login failed: state does not match'


This message is still specific to Auth0

itpropro · 2023-12-16T04:44:59Z

Hey @Azurency,
the current implementation in the security utils file is not RFC 7636 compliant. There are some issues with the generation of the verifier and the challenge, the verifier is saved server side, which should be the challenge (the other way around if used as confidential client) and the hash validation doesn't take place.
I would like to create a PR to adjust your implementation to the spec, but I have some questions:

What is the target of the current handler implementation for PKCE? There is currently no identity provider in this repo that would need a verification of the PKCE challenge or verifier on our Nuxt server side, as we are not issuing tokens to the user. The validation of the challenge takes place at the Idp, so auth0 in you example. The helper functions, as soon as adjusted to the spec are still helpful for usage in the providers though.
What is the target of the state check? The referenced auth0 documentation refers to SPA flow, but as we are using Nuxt SSR, we have a confidential client scenario. For simple CSRF protection, requiring a fixed CSRF header value would be enough, as this would force all client to make preflight requests. PKCE also helps mitigate some scenarios that can be abused due to a missing state, but I would assume that the state check would also just be used as a helper function inside of the respective providers, as it is also used for providing context to the application.

maximilianmikus · 2024-01-24T09:22:19Z

@itpropro
There is currently no identity provider in this repo that would need a verification of the PKCE challenge

As @Azurency states in the PR description:
The crypto methods and check logic could easily be extracted and reused in other oauth provider. I think that Google and Spotify accept the PKCE flow and Google and Twitch both accept a state check.
Also #25 relies on this

@itpropro I think it would be great if you could improve the implementation.

itpropro · 2024-03-26T22:52:51Z

@itpropro There is currently no identity provider in this repo that would need a verification of the PKCE challenge

As @Azurency states in the PR description: The crypto methods and check logic could easily be extracted and reused in other oauth provider. I think that Google and Spotify accept the PKCE flow and Google and Twitch both accept a state check. Also #25 relies on this

@itpropro I think it would be great if you could improve the implementation.

Hey,
I think I wasn't clear with my statement. I didn't mean that there is no authentication provider that would use PKCE, but they would validate the verifier on their end, so that there is no need to verify at the Nuxt server side. I was just talking about the right place and level of PKCE in the implementation as it's about having a "PKCE client" no a PKCE server implementation.
I think it makes sense to have some kind of pipeline where the requests go through and the supported/configured features are applied (like PKCE, Nonce, State, etc.).

amandesai01 · 2024-05-22T10:26:42Z

Thanks @itpropro I was exactly getting confused by the same issue all along while reading code changes and discussion.

Yes, PKCE is meant to be used by SPAs since they cannot have secret keys. All the security comes by providing correct redirect_uri to provider.

What I would suggest is adding those utils on client side, there by allowing this module to work with SPAs and nuxt generate. Then we can have a separate set of clients which work client side. I think it should be a separate discussion. Work done in this PR is extemely valuable but should be ported to client side.

pkg-pr-new · 2025-03-21T15:45:59Z

Open in Stackblitz

npm i https://pkg.pr.new/atinux/nuxt-auth-utils@12

commit: f12d454

Azurency force-pushed the main branch from 56258a7 to 4aea03d Compare November 10, 2023 21:54

Azurency force-pushed the main branch from 4aea03d to bc64538 Compare November 13, 2023 17:33

Azurency changed the title ~~feat: added simple pkce and state checks for auth0~~ feat: added simple PKCE and state checks utils, used PKCE and state checks in auth0 Nov 14, 2023

Azurency force-pushed the main branch from 160cd69 to 7113f98 Compare November 27, 2023 16:39

maximilianmikus reviewed Nov 29, 2023

View reviewed changes

maximilianmikus mentioned this pull request Nov 29, 2023

feat: add generic oidc provider #25

Closed

maximilianmikus reviewed Nov 30, 2023

View reviewed changes

Azurency force-pushed the main branch from db59fd3 to ff45896 Compare November 30, 2023 21:57

amandesai01 mentioned this pull request Jun 24, 2024

Add PKCE functionality to support authentication in SPAs #109

Open

feat: added simple pkce and state checks for auth0

f12d454

Azurency force-pushed the main branch from 68ec7de to f12d454 Compare March 21, 2025 15:45

Conversation

Azurency commented Nov 10, 2023

Uh oh!

justserdar commented Nov 11, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sifferhans commented Nov 12, 2023

Uh oh!

atinux commented Nov 12, 2023

Uh oh!

Azurency commented Nov 13, 2023

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

maximilianmikus commented Nov 29, 2023

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

itpropro commented Dec 16, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

maximilianmikus commented Jan 24, 2024

Uh oh!

itpropro commented Mar 26, 2024

Uh oh!

amandesai01 commented May 22, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new bot commented Mar 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

justserdar commented Nov 11, 2023 •

edited

Loading

itpropro commented Dec 16, 2023 •

edited

Loading

amandesai01 commented May 22, 2024 •

edited

Loading