Summary

This adds support for PKCE (Proof Key for Code Exchange) when Coder acts as an OIDC client. PKCE is an OAuth 2.0 extension (RFC 7636) that prevents authorization code interception attacks, making authentication more secure especially for public clients.

Problem

Some identity providers require or strongly recommend PKCE for OAuth2/OIDC flows. Without PKCE support, Coder cannot authenticate with these IdPs.

Changes

• Add CODER_OIDC_PKCE environment variable (default: false)
• Add --oidc-pkce flag to enable PKCE for OIDC authentication
• Add OAuth2PKCECookie constant for storing the PKCE verifier
• Modify ExtractOAuth2 middleware to:
  • Generate PKCE code verifier when initiating auth flow
  • Store verifier in HttpOnly cookie
  • Include code_challenge (S256) in authorization request
  • Pass code_verifier during token exchange
• Update all ExtractOAuth2 call sites with pkceEnabled parameter

Configuration

To enable PKCE for OIDC authentication:

export CODER_OIDC_PKCE=true

Or via CLI:

coder server --oidc-pkce

Implementation Details

• Uses S256 challenge method (SHA256 hash of verifier) as recommended by RFC 7636
• Verifier stored in HttpOnly cookie for CSRF protection
• Leverages golang.org/x/oauth2's built-in PKCE support (oauth2.GenerateVerifier(), oauth2.S256ChallengeOption(), oauth2.VerifierOption())
• Backward compatible - PKCE is disabled by default
• Only applies to OIDC authentication; GitHub and external auth remain unchanged

Testing

• Updated existing TestOAuth2 tests to pass pkceEnabled parameter
• All OAuth2 middleware tests pass

TODO (for follow-up)

• Add PKCE-specific tests
• Test with various IdPs (Okta, Azure AD, Keycloak, Google)
• Documentation updates

Related

• RFC 7636: Proof Key for Code Exchange
• OAuth 2.1 makes PKCE required by default