From 244ff8671493bb70e015855f6693818a1e388c63 Mon Sep 17 00:00:00 2001 From: CTO Date: Sat, 5 Sep 2026 09:56:07 +0000 Subject: [PATCH] docs(vikunja): note PKCE must be off on Pocket ID client (DEV-560) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Vikunja 2.x's frontend redirect helper and Go backend do not send code_challenge. Pocket ID rejects the /authorize call with 'code_challenge parameter is missing' when the client has pkceEnabled=true. The Vikunja client is confidential (isPublic=false) so client_secret still authenticates the token exchange — turning PKCE off is safe and required. Co-Authored-By: Paperclip --- apps/vikunja/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/apps/vikunja/README.md b/apps/vikunja/README.md index 574af33..8ba0b01 100644 --- a/apps/vikunja/README.md +++ b/apps/vikunja/README.md @@ -26,6 +26,7 @@ Both the app and Postgres pin to Hetzner location `fsn1` because their PVCs live - Pocket ID client `Vikunja` (id `cdfff4ee-28ba-4aab-9f47-7e41b4b6b847`), callback `https://vikunja.basicstack.de/auth/openid/basicstack`. - Pocket ID groups `vikunja_admins` and `vikunja_members`. - Vikunja does not map OIDC groups to the admin flag. Promote the first user post-login: `kubectl -n vikunja exec deploy/vikunja -- /app/vikunja/vikunja user set-admin --admin `. +- **PKCE must be OFF on the Pocket ID client.** Vikunja 2.x's OAuth redirect (`frontend/src/helpers/redirectToProvider.ts`) does not send `code_challenge`, and the Go backend does not implement PKCE either. With `pkceEnabled: true` on Pocket ID the flow fails at `/authorize` with `invalid_request … 'code_challenge' parameter is missing`. Client is confidential (`isPublic: false`), so `client_secret` still authenticates the token exchange. ## Optional: SMTP