Change OIDC default to Code + PKCE
Open
affected-medium
area-auth
breaking-change
enhancement
severity-minor
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
Code + PKCE is as secure as FormPost and avoids many of the issues with SameSite=None.
Change the nonce cookie SameSite default to lax? What about the correlation cookie?
Contributor guide
Assessment
This issue has not been assessed yet.