feat: test oidc state before token request

[csmig]

In oidcProvider.js:

• when redirecting to the OP authorization endpoint, store the state value we generated along with the PKCE code challenge we sent and the associated code verifier.
• when processing the OP's redirected authorization code response, test whether the OP state matches our last stored state. If it does, continue with a token request using the stored code verifier. If it does not, display an error and offer to restart the authorization flow.
• If the token request fails, display a textarea with context details including the saved PKCE data, the full authorization request, the OP's authorization code redirect URL, and the full token request body.

This might help in debugging esoteric issues as reported in #1440. The PKCE values can be found using DevTools or a JS console to view localStorage item last-oidc. The pkce.codeChallenge should be the URL encoded Base64 representation of the SHA256 digest of pkce.codeVerifier.

In a Linux shell, the proper code challenge for a given pkce.codeVerifier can be calculated by invoking:

echo -n "<pkce.codeVerifier>" | sha256sum | xxd -r -p | base64 | tr '+/' '-_' | tr -d '='

[sonarqubecloud]

Quality Gate passed for 'nuwcdivnpt_stig-manager-client'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud