[BUG] Missing `code_challenge` in Github OAuth PKCE progress
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 88/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- typescript
- Domain
- authentication
Research direction
Start in src/backend/database/routes/users.ts around lines 804 and 845-861, then review the GitHub OIDC authorization and callback flow. Reproduce the Docker 2.8.0 login failure or inspect the token exchange request, and verify that GitHub login succeeds without the missing code_verifier error.
Written by the indexing model from the issue text.
Description
Title
Github OIDC failed. Missing code_challenge
Platform
Website - Firefox
Server Installation Method
Docker
Version
2.8.0
CLI Installation Method
None
CLI Version
No response
Troubleshooting
- I have examined logs and tried to find the issue
- I have reviewed opened and closed issues
- I have tried restarting the application
- I have checked open issues and ensured this is not a duplicate
The Problem
I configured the Github for OIDC following https://docs.termix.site/features/authentication/github-google/
But when i tried to login with Github, it redirected to /users/oidc/callback but returned {"error":"Failed to exchange authorization code"}.
Logs:
[4:09:24 PM] [ERROR] [🔐] GitHub token exchange failed
{
operation: 'github_token_exchange_failed',
status: 400,
errorResponse: '{"error":"invalid_grant","error_description":"A code_verifier was not included, but the authorization request included a code_challenge. Codes requested with a code_challenge MUST be redeemed with a code_verifier.","error_uri":"https://docs.github.com/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-user-access-token-for-a-github-app"}'
}
[4:10:24 PM] [ERROR] [🔐] GitHub token exchange failed
{
operation: 'github_token_exchange_failed',
status: 400,
errorResponse: '{"error":"invalid_grant","error_description":"A code_verifier was not included, but the authorization request included a code_challenge. Codes requested with a code_challenge MUST be redeemed with a code_verifier.","error_uri":"https://docs.github.com/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-user-access-token-for-a-github-app"}'
}
Troubleshooting:
The authorize request carries code_challenge which needs code_verifier as presented in Github Docs
Related codes:
The following patch works:
diff --git a/src/backend/database/routes/users.ts b/src/backend/database/routes/users.ts
--- a/src/backend/database/routes/users.ts
+++ b/src/backend/database/routes/users.ts
@@ -804,6 +804,7 @@
client_secret: config.client_secret,
code: code,
redirect_uri: backendCallbackUri,
+ ...(storedCodeVerifier ? { code_verifier: storedCodeVerifier } : {}),
}),
...fetchOptions,
});
How to Reproduce
- Pull docker 2.8.0
- Configure Github as OIDC provider
- Login with Github
Additional Context
No response
- Dominant language
- No language data
- Stars
- 30
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Termix-SSH/Support
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 12/100
Termix-SSH/Support#1157 ·
All issues in Termix-SSH/Support
Similar issues
-
agent/reviewer
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
projectbluefin/utah-packages#634 ·
Maintainers usually reply within 1 day
-
io
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 73/100
Maintainers usually reply within 1 day
-
kind/bug needs-triage sig/release
Difficulty 2/5 1-3 hours Newbie friendliness 73/100
kubernetes/kubernetes#143392 · 1 comment ·
Maintainers usually reply within 1 day
-
area: backend bug good first issue hacktoberfest
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 3 days