From cb4ba2cc1fc50871bc4077ce683375727b35f1a0 Mon Sep 17 00:00:00 2001 From: LYJW131 Date: Fri, 26 Dec 2025 20:49:36 +0800 Subject: [PATCH] refactor: Improve Apple provider session authentication logic and eliminate its requirement for client keys. Signed-off-by: LYJW131 --- pkg/validation/providers.go | 5 +++++ providers/apple.go | 11 ++++++++++- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/pkg/validation/providers.go b/pkg/validation/providers.go index 0c8e28db..47b8c880 100644 --- a/pkg/validation/providers.go +++ b/pkg/validation/providers.go @@ -106,6 +106,11 @@ func providerRequiresClientSecret(provider options.Provider) bool { return false } + // Apple uses a private key to dynamically generate client_secret JWTs + if provider.Type == "apple" { + return false + } + return true } diff --git a/providers/apple.go b/providers/apple.go index b9d3f6a4..87d928f8 100644 --- a/providers/apple.go +++ b/providers/apple.go @@ -295,11 +295,20 @@ func (p *AppleProvider) RefreshSession(ctx context.Context, s *sessions.SessionS func (p *AppleProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool { ctx = oidc.ClientContext(ctx, requests.DefaultHTTPClient) + // Validate ID token if present if s.IDToken != "" && p.Verifier != nil { if _, err := p.Verifier.Verify(ctx, s.IDToken); err != nil { return false } + // ID token is valid - Apple doesn't provide a token validation endpoint, + return true } - return validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken)) + // Fallback to access token validation if ValidateURL is set + if p.ValidateURL != nil && p.ValidateURL.String() != "" { + return validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken)) + } + + // No validation possible, but session exists with valid data + return s.AccessToken != "" }