mirror of
https://github.com/immich-app/immich
synced 2026-08-15 13:03:57 +00:00
5ba3446fdf
Immich's OAuth flow never sent a `nonce`, so oauth4webapi's default `expectNoNonce` rejected any id_token carrying one. Providers that inject a nonce on federated logins (e.g. AWS Cognito relaying Google) therefore broke with OAUTH_JWT_CLAIM_COMPARISON_FAILED: unexpected ID Token "nonce" claim. Generate a real nonce in authorize(), round-trip it (web via httpOnly cookie, mobile via the callback DTO since the client generates its own state/PKCE), and pass it as expectedNonce to authorizationCodeGrant so the value is verified per the OIDC spec. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| constants | ||
| domain | ||
| entities | ||
| extensions | ||
| infrastructure | ||
| interfaces | ||
| mixins | ||
| models | ||
| pages | ||
| presentation | ||
| providers | ||
| repositories | ||
| routing | ||
| services | ||
| theme | ||
| utils | ||
| widgets | ||
| main.dart | ||
| wm_executor.dart | ||