[Bug]: Missing PKCE support for OIDC to protect against Authorization Code Interception Attacks #13730
Description
What happened?
I'm using kanidm as my IdP and OIDC provider, which enforces PKCE (and ideally ES256) support. This is important to prevent Authorization Code Interception Attacks on mobile devices. See Okta's writeup or this stackexchange post for more information.
Distribution version
Linux
App Version
No response
What browsers are you seeing the problem on if you're using web version?
Other
Are you self-hosting?
- Yes
Self-hosting Version
v0.24.3
Relevant log output
Anything else?
No response