Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OIDC: increase length of generated nonce parameter from 30->32 chars #18109

Merged
merged 4 commits into from
Jan 27, 2025
+16 −1
Merged

OIDC: increase length of generated nonce parameter from 30->32 chars #18109

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1e78713
OIDC: increase length of generated `nonce` parameter from 30->32 chars
anoadragon453 Jan 27, 2025
2e51d86
newsfile
anoadragon453 Jan 27, 2025
4d0afea
Add comment explaining the reasoning behind upping nonce length
anoadragon453 Jan 27, 2025
2bb53d5
lint
anoadragon453 Jan 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelog.d/18109.misc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Increase the length of the generated `nonce` parameter when perfoming OIDC logins to comply with the TI-Messenger spec.
16 changes: 15 additions & 1 deletion synapse/handlers/oidc.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1002,7 +1002,21 @@ async def handle_redirect_request(
"""

state = generate_token()
nonce = generate_token()

# Generate a nonce 32 characters long. When encoded with base64url later on,
# the nonce will be 43 characters when sent to the identity provider.
#
# While RFC7636 does not specify a minimum length for the `nonce`
# parameter, the TI-Messenger IDP_FD spec v1.7.3 does require it to be
# between 43 and 128 characters. This spec concerns using Matrix for
# communication in German healthcare.
#
# As increasing the length only strengthens security, we use this length
# to allow TI-Messenger deployments using Synapse to satisfy this
# external spec.
#
# See https://github.com/element-hq/synapse/pull/18109 for more context.
nonce = generate_token(length=32)
anoadragon453 marked this conversation as resolved.
Show resolved Hide resolved
code_verifier = ""

if not client_redirect_url:
Expand Down
Loading