mirror of
https://github.com/immich-app/immich
synced 2026-08-29 13:15:45 +00:00
5ba3446fdf
Immich's OAuth flow never sent a `nonce`, so oauth4webapi's default `expectNoNonce` rejected any id_token carrying one. Providers that inject a nonce on federated logins (e.g. AWS Cognito relaying Google) therefore broke with OAUTH_JWT_CLAIM_COMPARISON_FAILED: unexpected ID Token "nonce" claim. Generate a real nonce in authorize(), round-trip it (web via httpOnly cookie, mobile via the callback DTO since the client generates its own state/PKCE), and pass it as expectedNonce to authorizationCodeGrant so the value is verified per the OIDC spec. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| activities | ||
| album | ||
| asset_grid | ||
| asset_viewer | ||
| backup | ||
| common | ||
| forms | ||
| map | ||
| memories | ||
| photo_view | ||
| search | ||
| settings | ||
| shared_link | ||