Loading...

XML

Word

Printable

Type: Bug
Resolution: Unresolved
Priority: Critical
Fix Version/s: None
Affects Version/s: 4.16, 4.17, 4.18, 4.19
Component/s: oauth-apiserver
Labels:
- nonce
- oauth2
- oauth2.1
- openid

Activity Type:
Quality / Stability / Reliability
Blocked:
False
Blocked Reason:

Hide

None

Show
None
Story Points:
None
Severity:
Critical
Regression:
No
Architecture:

All
Deployment Environment:
Production

Target Backport Versions:
None
Target Version:
None
Release Blocker:
None
Sprint:
None

SFDC Cases Counter:
SFDC Cases Open:
SFDC Cases Links:

Release Note Status:
None
Release Note Type:
None
Release Note Text:
None

Escape Reason:
None
Escape Impact:
None
Corrective Measures:
None
SDLC stage when should've been found:
None

Description of problem:

Support for nonce and OAuth 2.1 on RedHat OpenShift OAuth server

Version-Release number of selected component (if applicable):

    4.19

How reproducible:

    nonce is not honoured in the Authorization endpoint url and PKCE is not supported. Other security hardening requirements for OAuth 2.1 are not supported

Steps to Reproduce:

    1. Call OpenShift authorize endpoint and pass nonce as a query parameter
    2. https://<namespace_route>/oauth/authorize?client_id=client_id&nonce=nonce_value
    3. No support for code_challenge and code_verifer

Actual results:

    nonce is not supported and PKCE is not supported

Expected results:

    Successful nonce validation

Additional info:

Assignee:: Unassigned

Reporter:: Rashmi Khanna (Inactive)

Need Info From:: None

Contributors:: None

QA Contact:: None

Doc Contact:: None

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Created:: 2025/07/28 2:28 PM

Updated:: 2025/07/28 5:27 PM