snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

selfservice/strategy/oidc/pkce_test.go

@@ -0,0 +1,100 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package oidc_test
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	oidcv1 "github.com/ory/kratos/gen/oidc/v1"
+	"github.com/ory/kratos/pkg"
+	"github.com/ory/kratos/selfservice/flow/login"
+	"github.com/ory/kratos/selfservice/flow/registration"
+	"github.com/ory/kratos/selfservice/strategy/oidc"
+	"github.com/ory/kratos/x"
+)
+
+func TestPKCESupport(t *testing.T) {
+	t.Parallel()
+
+	supported := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = fmt.Fprintf(w, `{"issuer": "http://%s", "code_challenge_methods_supported":["S256"]}`, r.Host)
+	}))
+	t.Cleanup(supported.Close)
+	notSupported := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = fmt.Fprintf(w, `{"issuer": "http://%s", "code_challenge_methods_supported": ["plain"]}`, r.Host)
+	}))
+	t.Cleanup(notSupported.Close)
+
+	_, reg := pkg.NewFastRegistryWithMocks(t)
+	strat := oidc.NewStrategy(reg)
+
+	for _, tc := range []struct {
+		c    *oidc.Configuration
+		pkce bool
+	}{
+		{c: &oidc.Configuration{IssuerURL: supported.URL, PKCE: "force"}, pkce: true},
+		{c: &oidc.Configuration{IssuerURL: supported.URL, PKCE: "never"}, pkce: false},
+		{c: &oidc.Configuration{IssuerURL: supported.URL, PKCE: "auto"}, pkce: true},
+		{c: &oidc.Configuration{IssuerURL: supported.URL, PKCE: ""}, pkce: true}, // same as auto
+
+		{c: &oidc.Configuration{IssuerURL: notSupported.URL, PKCE: "force"}, pkce: true},
+		{c: &oidc.Configuration{IssuerURL: notSupported.URL, PKCE: "never"}, pkce: false},
+		{c: &oidc.Configuration{IssuerURL: notSupported.URL, PKCE: "auto"}, pkce: false},
+		{c: &oidc.Configuration{IssuerURL: notSupported.URL, PKCE: ""}, pkce: false}, // same as auto
+
+		{c: &oidc.Configuration{IssuerURL: "", PKCE: "force"}, pkce: true},
+		{c: &oidc.Configuration{IssuerURL: "", PKCE: "never"}, pkce: false},
+		{c: &oidc.Configuration{IssuerURL: "", PKCE: "auto"}, pkce: false},
+		{c: &oidc.Configuration{IssuerURL: "", PKCE: ""}, pkce: false}, // same as auto
+
+	} {
+		provider := oidc.NewProviderGenericOIDC(tc.c, reg)
+
+		flow := &login.Flow{
+			ID: x.NewUUID(),
+		}
+
+		stateParam, pkce, err := strat.GenerateState(t.Context(), provider, flow, "https://testhost")
+		require.NoError(t, err)
+		require.NotEmpty(t, stateParam)
+
+		state, err := oidc.DecryptState(t.Context(), reg.Cipher(t.Context()), stateParam)
+		require.NoError(t, err)
+		assert.Equal(t, oidcv1.FlowKind_FLOW_KIND_LOGIN, state.FlowKind)
+		assert.Equal(t, "https://testhost", state.RequestBaseUrl)
+
+		if tc.pkce {
+			require.NotEmpty(t, pkce)
+			require.NotEmpty(t, oidc.PKCEVerifier(state))
+		} else {
+			require.Empty(t, pkce)
+			require.Empty(t, oidc.PKCEVerifier(state))
+		}
+	}
+
+	t.Run("OAuth1", func(t *testing.T) {
+		for _, provider := range []oidc.Provider{
+			oidc.NewProviderX(&oidc.Configuration{IssuerURL: supported.URL, PKCE: "force"}, reg),
+			oidc.NewProviderX(&oidc.Configuration{IssuerURL: supported.URL, PKCE: "never"}, reg),
+			oidc.NewProviderX(&oidc.Configuration{IssuerURL: supported.URL, PKCE: "auto"}, reg),
+		} {
+			stateParam, pkce, err := strat.GenerateState(t.Context(), provider, &registration.Flow{ID: x.NewUUID()}, "https://testhost")
+			require.NoError(t, err)
+			require.NotEmpty(t, stateParam)
+			assert.Empty(t, pkce)
+
+			state, err := oidc.DecryptState(t.Context(), reg.Cipher(t.Context()), stateParam)
+			require.NoError(t, err)
+			assert.Empty(t, oidc.PKCEVerifier(state))
+			assert.Equal(t, oidcv1.FlowKind_FLOW_KIND_REGISTRATION, state.FlowKind)
+			assert.Equal(t, "https://testhost", state.RequestBaseUrl)
+		}
+	})
+}