mirror of
https://github.com/immich-app/immich
synced 2026-08-15 13:03:57 +00:00
5ba3446fdf
Immich's OAuth flow never sent a `nonce`, so oauth4webapi's default `expectNoNonce` rejected any id_token carrying one. Providers that inject a nonce on federated logins (e.g. AWS Cognito relaying Google) therefore broke with OAUTH_JWT_CLAIM_COMPARISON_FAILED: unexpected ID Token "nonce" claim. Generate a real nonce in authorize(), round-trip it (web via httpOnly cookie, mobile via the callback DTO since the client generates its own state/PKCE), and pass it as expectedNonce to authorizationCodeGrant so the value is verified per the OIDC spec. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| cli | ||
| e2e-auth-server | ||
| plugin-core | ||
| plugin-sdk | ||
| scripts | ||
| sdk | ||