support PKCE

src/hooks.server.ts

@@ -148,11 +148,7 @@ export const handle: Handle = async ({ event, resolve }) => {
 			) {
 				// To get the same CSRF token after callback
 				refreshSessionCookie(event.cookies, auth.secretSessionId);
-				return await triggerOauthFlow({
-					request: event.request,
-					url: event.url,
-					locals: event.locals,
-				});
+				return await triggerOauthFlow(event);
 			}
 		} else {
 			// Redirect to OAuth flow unless on the authorized pages (home, shared conversation, login, healthcheck, model thumbnails)
@@ -168,7 +164,7 @@ export const handle: Handle = async ({ event, resolve }) => {
 				!event.url.pathname.startsWith(`${base}/api`)
 			) {
 				refreshSessionCookie(event.cookies, auth.secretSessionId);
-				return triggerOauthFlow({ request: event.request, url: event.url, locals: event.locals });
+				return triggerOauthFlow(event);
 			}
 		}
 	}

src/lib/server/auth.ts

@@ -4,7 +4,9 @@ import {
 	type UserinfoResponse,
 	type TokenSet,
 	custom,
+	generators,
 } from "openid-client";
+import type { RequestEvent } from "@sveltejs/kit";
 import { addHours, addWeeks, differenceInMinutes, subMinutes } from "date-fns";
 import { config } from "$lib/server/config";
 import { sha256 } from "$lib/utils/sha256";
@@ -281,7 +283,7 @@ async function getOIDCClient(settings: OIDCSettings, url: URL): Promise<BaseClie
 
 export async function getOIDCAuthorizationUrl(
 	settings: OIDCSettings,
-	params: { sessionId: string; next?: string; url: URL }
+	params: { sessionId: string; next?: string; url: URL; cookies: Cookies }
 ): Promise<string> {
 	const client = await getOIDCClient(settings, params.url);
 	const csrfToken = await generateCsrfToken(
@@ -290,7 +292,20 @@ export async function getOIDCAuthorizationUrl(
 		sanitizeReturnPath(params.next)
 	);
 
+	const codeVerifier = generators.codeVerifier();
+	const codeChallenge = generators.codeChallenge(codeVerifier);
+
+	params.cookies.set("hfChat-codeVerifier", codeVerifier, {
+		path: "/",
+		sameSite,
+		secure,
+		httpOnly: true,
+		expires: addHours(new Date(), 1),
+	});
+
 	return client.authorizationUrl({
+		code_challenge_method: "S256",
+		code_challenge: codeChallenge,
 		scope: OIDConfig.SCOPES,
 		state: csrfToken,
 		resource: OIDConfig.RESOURCE || undefined,
@@ -300,11 +315,16 @@ export async function getOIDCAuthorizationUrl(
 export async function getOIDCUserData(
 	settings: OIDCSettings,
 	code: string,
+	codeVerifier: string,
 	iss: string | undefined,
 	url: URL
 ): Promise<OIDCUserInfo> {
 	const client = await getOIDCClient(settings, url);
-	const token = await client.callback(settings.redirectURI, { code, iss });
+	const token = await client.callback(settings.redirectURI, {
+		code,
+		iss,
+		checks: { code_verifier: codeVerifier },
+	});
 	const userData = await client.userinfo(token);
 
 	return { token, userData };
@@ -514,14 +534,7 @@ export async function authenticateRequest(
 	return { user: undefined, sessionId, secretSessionId, isAdmin: false };
 }
 
-export async function triggerOauthFlow({
-	url,
-	locals,
-}: {
-	request: Request;
-	url: URL;
-	locals: App.Locals;
-}): Promise<Response> {
+export async function triggerOauthFlow({ url, locals, cookies }: RequestEvent): Promise<Response> {
 	// const referer = request.headers.get("referer");
 	// let redirectURI = `${(referer ? new URL(referer) : url).origin}${base}/login/callback`;
 	let redirectURI = `${url.origin}${base}/login/callback`;
@@ -551,7 +564,7 @@ export async function triggerOauthFlow({
 
 	const authorizationUrl = await getOIDCAuthorizationUrl(
 		{ redirectURI },
-		{ sessionId: locals.sessionId, next, url }
+		{ sessionId: locals.sessionId, next, url, cookies }
 	);
 
 	throw redirect(302, authorizationUrl);

src/routes/login/+server.ts

@@ -1,5 +1,5 @@
 import { triggerOauthFlow } from "$lib/server/auth";
 
-export async function GET({ request, url, locals }) {
-	return await triggerOauthFlow({ request, url, locals });
+export async function GET(event) {
+	return await triggerOauthFlow(event);
 }

src/routes/login/callback/+server.ts

@@ -52,9 +52,15 @@ export async function GET({ url, locals, cookies, request, getClientAddress }) {
 		throw error(403, "Invalid or expired CSRF token");
 	}
 
+	const codeVerifier = cookies.get("hfChat-codeVerifier");
+	if (!codeVerifier) {
+		throw error(403, "Code verifier cookie not found");
+	}
+
 	const { userData, token } = await getOIDCUserData(
 		{ redirectURI: validatedToken.redirectUrl },
 		code,
+		codeVerifier,
 		iss,
 		url
 	);