Feature/OIDC authenticate flow#448

Open

jurei733 wants to merge 40 commits into

feature/oidc-authenticate-flow

Commits on Jun 1, 2026

Move auth flow to backend
jurei733
committed
Update the README with a new section explaining the Keycloak OAuth2 Authorization Code authentication flow.
jurei733
committed
Fixes security issue for the untrusted URL redirect vulnerability
jurei733
committed
Fixes the type confusion vulnerability in the auth controller callback method
jurei733
committed
Fixes the server-side URL redirect vulnerability in the authentication controller
jurei733
committed
Ensure that JWT_SECRET infrastructure is dismantled since Keycloak now handles all token verification, and error redirects are securely validated against the KEYCLOAK_URL to prevent open redirect v…
jurei733
committed
Fix the authentication crash issue by adding safe decodeURIComponent handling
jurei733
committed
Fix the authentication callback error handling issue
jurei733
committed
Refactor that Keycloak configuration values (keycloakUrl, keycloakRealm, clientId, clientSecret) are now initialized once in the class constructor as private readonly properties
jurei733
committed
Configure the routing through environment variables instead of hard-coded logic
jurei733
committed
Remove processing of obsolete environment variable 'JWT_SECRET'

svwolter
authored and
jurei733
committed
Rename 'KEYCLOAK_URL' to 'OIDC_PROVIDER_URL'

svwolter
authored and
jurei733
committed
Rename 'KEYCLOAK_REALM' to 'OIDC_REALM'

svwolter
authored and
jurei733
committed
Rename 'KEYCLOAK_CLIENT_ID' to 'OAUTH2_CLIENT_ID'

svwolter
authored and
jurei733
committed
Rename 'KEYCLOAK_CLIENT_SECRET' to 'OAUTH2_CLIENT_SECRET'

svwolter
authored and
jurei733
committed
Generalize Keycloak integration to OIDC

svwolter
authored and
jurei733
committed
Roll back the 'Nginx OIDC runtime configuration'

svwolter
authored and
jurei733
committed
Delete obsolete docker compose environment variable 'API_HOST'

svwolter
authored and
jurei733
committed
Revise processing of docker compose environment variable 'BACKEND_CALLBACK_BASE_PATH'

svwolter
authored and
jurei733
committed
Revise docker compose environment files

svwolter
authored and
jurei733
committed
Revise install script

svwolter
authored and
jurei733
committed
Add initial coding box keycloak realm

svwolter
authored and
jurei733
committed
Move auth flow to backend
jurei733
committed
Implement PKCE support for OIDC authentication flow, overhaul backend PKCE logic, and refactor frontend OIDC integration.
jurei733
committed
Add keycloak dev environment

svwolter
authored and
jurei733
committed
Add Postgres 14 image pull to dev makefile
jurei733
committed
Add "admin" role to coding-box-realm configuration
jurei733
committed
Update README with Keycloak realm setup and timestamp replacement steps
jurei733
committed
Add comprehensive documentation for OIDC authentication flow, including Keycloak integration, environment setup, backend implementation, frontend integration, and troubleshooting steps.
jurei733
committed
Remove unnecessary "peer" field entries and dependency "path-to-regexp" from package-lock.json and package.json
jurei733
committed
Add initial .env file with configuration values for Redis, Postgres, API, Frontend, Keycloak, and OIDC integration
jurei733
committed
Update default admin credentials and document them for local development setup
jurei733
committed
Refactor workspace creation and testing for consistency and enhanced OIDC identity handling
jurei733
committed
Fix OAuth redirect validation
jurei733
committed
test: allow docx integration test more time
jurei733
committed
Fix OIDC rebase conflict regressions
jurei733
committed