Mattia Bertorello 5ba3446fdf fix(oauth): send and verify a nonce to tolerate IdP-injected nonces ... Immich's OAuth flow never sent a `nonce`, so oauth4webapi's default `expectNoNonce` rejected any id_token carrying one. Providers that inject a nonce on federated logins (e.g. AWS Cognito relaying Google) therefore broke with OAUTH_JWT_CLAIM_COMPARISON_FAILED: unexpected ID Token "nonce" claim. Generate a real nonce in authorize(), round-trip it (web via httpOnly cookie, mobile via the callback DTO since the client generates its own state/PKCE), and pass it as expectedNonce to authorizationCodeGrant so the value is verified per the OIDC spec. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-08-14 08:12:04 +02:00
..
bin	chore(mobile): remove OpenAPI generated code (#30287)	2026-07-29 20:33:30 +00:00
patch	chore: immich_mobile path in openapi pubspec (#30643)	2026-08-12 23:00:08 +05:30
templates/mobile	chore(mobile): harden mobile OpenAPI codegen and dependency install (#30202)	2026-07-27 06:07:31 -07:00
immich-openapi-specs.json	fix(oauth): send and verify a nonce to tolerate IdP-injected nonces	2026-08-14 08:12:04 +02:00
openapitools.json	chore: bump openapi-generator version to v7.24.0 (#30067)	2026-07-20 20:06:23 -04:00