Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PKCE: Unset oauth2pkceCode from session after login? #991

Open
hkirsman opened this issue Feb 16, 2023 · 0 comments
Open

PKCE: Unset oauth2pkceCode from session after login? #991

hkirsman opened this issue Feb 16, 2023 · 0 comments

Comments

@hkirsman
Copy link

There's this example in dev release for PKCE

// Store the PKCE code after the `getAuthorizationUrl()` call.
$_SESSION['oauth2pkceCode'] = $provider->getPkceCode();
// ...
// Restore the PKCE code before the `getAccessToken()` call. 
$provider->setPkceCode($_SESSION['oauth2pkceCode']);

What about unsettling the $_SESSION['oauth2pkceCode'] after setPkceCode() is done?

unset($_SESSION['oauth2pkceCode']);

There's no reason to keep it around, is there?

@hkirsman hkirsman changed the title PKCE: Unset from oauth2pkceCode session after login? PKCE: Unset oauth2pkceCode from session after login? Feb 16, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant