public_git
/
oauth2-proxy
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

refactor: Improve Apple provider session authentication logic and eliminate its requirement for client keys. 

Signed-off-by: LYJW131 <lyjw2007@gmail.com>
This commit is contained in:
LYJW131 2025-12-26 20:49:36 +08:00
parent a7062d45b3
commit cb4ba2cc1f
2 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
pkg/validation/providers.go
View File

@ -106,6 +106,11 @@ func providerRequiresClientSecret(provider options.Provider) bool {
return false
}
// Apple uses a private key to dynamically generate client_secret JWTs
if provider.Type == "apple" {
return false
}
return true
}

11
providers/apple.go
View File

@ -295,11 +295,20 @@ func (p *AppleProvider) RefreshSession(ctx context.Context, s *sessions.SessionS
func (p *AppleProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {
ctx = oidc.ClientContext(ctx, requests.DefaultHTTPClient)
// Validate ID token if present
if s.IDToken != "" && p.Verifier != nil {
if _, err := p.Verifier.Verify(ctx, s.IDToken); err != nil {
return false
}
// ID token is valid - Apple doesn't provide a token validation endpoint,
return true
}
return validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken))
// Fallback to access token validation if ValidateURL is set
if p.ValidateURL != nil && p.ValidateURL.String() != "" {
return validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken))
}
// No validation possible, but session exists with valid data
return s.AccessToken != ""
}