fix(google): round-trip PKCE code_verifier through OAuth state - #108
Open
DouwMarx wants to merge 1 commit into
Open
fix(google): round-trip PKCE code_verifier through OAuth state#108DouwMarx wants to merge 1 commit into
DouwMarx wants to merge 1 commit into
Conversation
google-auth-oauthlib defaults autogenerate_code_verifier=True, so /authorize and /callback each generated a different verifier in their own Flow. fetch_token then failed Google's PKCE check and raised, surfacing as a 500 Internal Server Error after the user granted consent. Mint the verifier once in google_authorize (and reauthorize_account), persist it in the Redis OAuth state next to the user id, and echo it in google_callback with autogenerate_code_verifier=False. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Google OAuth setup returns 500 Internal Server Error after the user grants consent.
google-auth-oauthlibdefaultsautogenerate_code_verifier=True, so/authorizeand/callbackeach build their ownFlowand generate a different PKCE verifier./authorizesends the challenge for verifier A;/callbackthen callsfetch_tokenwith verifier B, Google rejects the PKCE check,fetch_tokenraises, and with no error handling around it FastAPI returns a 500.Fix
Mint the verifier once and round-trip it through the existing Redis OAuth state:
google_authorize/reauthorize_account: generate the verifier, pass it to theFlow, and store it in the state payload alongside the user id.GoogleOAuthState.create/validate: state payload is now JSON{user_id, code_verifier}instead of a bare user id.google_callback: read the verifier back and pass it withautogenerate_code_verifier=Falseso the challenge matches.Test
Updated
test_google_callback_parses_scopes_from_urlfor the newvalidate()tuple return. Real end-to-end verification is the browser Google-setup flow.