From 75822f632a399bd7234150c5933e867ff084dce0 Mon Sep 17 00:00:00 2001
From: shamoon <4887959+shamoon@users.noreply.github.com>
Date: Mon, 13 Jul 2026 10:18:49 -0700
Subject: [PATCH] Security: enable PKCE for OIDC

---
 src/__tests__/pages/api/auth/[...nextauth].test.js | 1 +
 src/pages/api/auth/[...nextauth].js                | 1 +
 2 files changed, 2 insertions(+)

diff --git a/src/__tests__/pages/api/auth/[...nextauth].test.js b/src/__tests__/pages/api/auth/[...nextauth].test.js
index 7694f2b08..c1a4446cb 100644
--- a/src/__tests__/pages/api/auth/[...nextauth].test.js
+++ b/src/__tests__/pages/api/auth/[...nextauth].test.js
@@ -205,6 +205,7 @@ describe("pages/api/auth/[...nextauth]", () => {
       name: "My OIDC",
       type: "oauth",
       idToken: true,
+      checks: ["pkce", "state"],
       issuer: "https://issuer.example",
       wellKnown: "https://issuer.example/.well-known/openid-configuration",
       clientId: "client-id",
diff --git a/src/pages/api/auth/[...nextauth].js b/src/pages/api/auth/[...nextauth].js
index 2ada235d0..74e5c95e3 100644
--- a/src/pages/api/auth/[...nextauth].js
+++ b/src/pages/api/auth/[...nextauth].js
@@ -73,6 +73,7 @@ if (authEnabled) {
         name: process.env.HOMEPAGE_OIDC_NAME || "Homepage OIDC",
         type: "oauth",
         idToken: true,
+        checks: ["pkce", "state"],
         issuer: cleanedIssuer,
         wellKnown: `${cleanedIssuer}/.well-known/openid-configuration`,
         clientId,