supabase / gotrue / 6533204770

65%

push

github

feat: add `GOTRUE_<PROVIDER>_SKIP_NONCE_CHECK` to skip nonce checks in ODIC flow (#1264)

It appears that in certain client libraries that deal with the OIDC
authentication flow, such as [this one for React Native on
iOS](https://github.com/google/GoogleSignIn-iOS/pull/244), the clients
are unable to extract the nonce that is generated randomly by the
library.

This option allows to temporarily drop the enforcement at the GoTrue
level when performing the OIDC flow. This does remove an important
security barrier, which could potentially allow "stolen" ID tokens to be
used on third-party services (that have opted in to this configuration)
however in the interest of flexibility and broad platform support the
option is being added.

18 of 18 new or added lines in 1 file covered. (100.0%)

7426 of 11318 relevant lines covered (65.61%)

51.48 hits per line