WeChat ID
aaronpk_tv
Thursday, February 24, 2022
-
-
-
Indie bookshelves - macwright.com (macwright.com)"Check out all the stuff that Aaron Parecki has implemented to run his website. That isn’t a home on the internet, it’s a full-fledged castle. It’s damn impressive."
-
Brock Allen
https://twitter.com/BrockLAllen
•
Feb 25
Hey @aaronpk, can you explain this help article? It makes no sense to me. TIA
https://support.okta.com/help/s/article/Browser-requests-to-the-token-endpoint-must-use-Proof-Key-for-Code-Exchange?language=en_US
Oh yeah, I remember this one. I don't remember if this is still current behavior, but basically Okta is tying to prevent browsers from using anything other than the authorization code PKCE flow. It does that by detecting the Origin header which isn't sent by server apps. -
Brock Allen
https://twitter.com/BrockLAllen
•
Feb 25
It's confusing as hell, and I'm confused by the implementation -- on the token endpoint if Origin is present, you require that the authz used PKCE? That's about the only valid approach to that I can imagine.
Yeah that's right. I agree it's super confusing and has caused some tricky issues before. It may be different in the new platform but I'd have to double check
-
Brock Allen
https://twitter.com/BrockLAllen
•
Feb 25
People are asking, when using standards compliant OIDC client libraries:
https://github.com/authts/oidc-client-ts/issues/395#issue-1149525542
why does that example have the browser sending a client secret in the request? That seems odd. Happy to continue this over on the github thread. -
Brock Allen
https://twitter.com/BrockLAllen
•
Feb 25
Ah, good question -- I didn't notice that. I bet their client config is misconfigured then.
Yep, I confirmed my suspicion. Misleading error message. Will post details on the github thread.
-
Hirsch Singhal
https://twitter.com/hpsin_
•
Feb 25
Helps prevent devs from putting their client secrets in a web page to perform the client creds flow, yep. When AAD enabled this, we definitely got a couple support calls on that. This was how we ratcheted forward PKCE use from suggested to required as well.
yep you guessed it! misleading error message but that's exactly what was going on. -
Brock Allen
https://twitter.com/BrockLAllen
•
Feb 25
Arguably, tho, PKCE and putting a client secret into a SPA are orthogonal. It's conflating two things that work differently. Poor devs can't understand those differences.
The error should be "we see you sent a client secret and an Origin header. is your client a SPA?"
I totally agree, this error message makes no sense. I'm going to file a ticket tomorrow internally to fix it. -
I'll be there for the second half of the day! Looking forward to it!
-
Well that's quite the sentence:
"Facebook has built its empire on the ability to acquire intimate details about user behavior across the internet"
https://9to5mac.com/2022/02/24/app-tracking-transparency-harmful-says-facebook/ -
For those asking, @npr goes with Ukrainian spelling & pronunciation (not Russian) wherever possible when reporting on Ukraine.
Kyiv not Kiev. KEE-eve not KEE-yev.
Hat tip: @michelekelemen @wexler_m
#Kyiv #Ukraine
