OIDC Nonce and OAuth State Support

CHANGELOG.md

@@ -1,8 +1,12 @@
 # Change Log
 
+## [2.3.0] 2026-06-05
+
+* [Pull #337](https://github.com/uber/uber-ios-sdk/pull/337) OIDC Nonce and OAuth State Support
+
 ## [2.2.1] 2026-05-13
 
-* [Pull #332](https://github.com/uber/uber-ios-sdk/pull/335) Clear plist fields
+* [Pull #335](https://github.com/uber/uber-ios-sdk/pull/335) Clear plist fields
 
 ## [2.2.0] 2026-05-05
 

Sources/UberAuth/AuthProviding.swift

@@ -39,6 +39,12 @@ public protocol AuthProviding {
 
     func logout() -> Bool
 
+    /// Attempts to handle an incoming URL on the native path.
+    ///
+    /// - Returns: `true` if the URL was claimed by this provider — meaning it matched the redirect
+    ///   URI and an active auth flow was in progress. A `true` return indicates the URL was handled,
+    ///   the outcome (success or failure) is delivered via the completion passed to `execute`.
+    ///   Returns `false` if the URL does not belong to this provider.
     func handle(response url: URL) -> Bool
 
     var isLoggedIn: Bool { get }

Sources/UberAuth/Authorize/AuthenticationSession.swift

@@ -31,8 +31,9 @@ protocol AuthenticationSessioning {
     init(anchor: ASPresentationAnchor,
          callbackURLScheme: String,
          url: URL,
+         pendingState: String?,
          completion: @escaping AuthCompletion)
-    
+
     func start()
 }
 
@@ -43,8 +44,9 @@ final class AuthenticationSession: AuthenticationSessioning {
     private let presentationContextProvider: ASWebAuthenticationPresentationContextProviding?
 
     init(anchor: ASPresentationAnchor = ASPresentationAnchor(),
-         callbackURLScheme: String, 
+         callbackURLScheme: String,
          url: URL,
+         pendingState: String? = nil,
          completion: @escaping AuthCompletion) {
         self.presentationContextProvider = AuthPresentationContextProvider(anchor: anchor)
         self.authSession = ASWebAuthenticationSession(
@@ -57,6 +59,10 @@ final class AuthenticationSession: AuthenticationSessioning {
                 case (.none, _):
                     completion(.failure(UberAuthError.invalidAuthCode))
                 case (.some(let url), _):
+                    if let pending = pendingState, State.value(from: url) != pending {
+                        completion(.failure(.stateMismatch))
+                        return
+                    }
                     guard let code = Self.parse(url: url) else {
                         completion(.failure(Self.parseError(url: url)))
                         return