From 2fae37b004ea48a968b8af59c09630cba0839fb5 Mon Sep 17 00:00:00 2001
From: shamoon <4887959+shamoon@users.noreply.github.com>
Date: Fri, 7 Aug 2026 12:18:47 -0700
Subject: [PATCH] Fix: enforce nonce OIDC check too

---
 src/__tests__/pages/api/auth/[...nextauth].test.js | 2 +-
 src/pages/api/auth/[...nextauth].js                | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/__tests__/pages/api/auth/[...nextauth].test.js b/src/__tests__/pages/api/auth/[...nextauth].test.js
index fee9cb31f..e963b3b59 100644
--- a/src/__tests__/pages/api/auth/[...nextauth].test.js
+++ b/src/__tests__/pages/api/auth/[...nextauth].test.js
@@ -281,7 +281,7 @@ describe("pages/api/auth/[...nextauth]", () => {
       name: "My OIDC",
       type: "oauth",
       idToken: true,
-      checks: ["pkce", "state"],
+      checks: ["pkce", "state", "nonce"],
       issuer: "https://issuer.example",
       wellKnown: "https://issuer.example/.well-known/openid-configuration",
       clientId: "client-id",
diff --git a/src/pages/api/auth/[...nextauth].js b/src/pages/api/auth/[...nextauth].js
index de9fe0445..a133e922b 100644
--- a/src/pages/api/auth/[...nextauth].js
+++ b/src/pages/api/auth/[...nextauth].js
@@ -87,7 +87,7 @@ if (authEnabled) {
         name: process.env.HOMEPAGE_OIDC_NAME || "Homepage OIDC",
         type: "oauth",
         idToken: true,
-        checks: ["pkce", "state"],
+        checks: ["pkce", "state", "nonce"],
         issuer: cleanedIssuer,
         wellKnown: `${cleanedIssuer}/.well-known/openid-configuration`,
         clientId,