oidc

tinox.core.oidc, split out of the bundled stdlib as a standalone tinox-central package.

Verify id token

import tinox.core.oidc

class Main
{
    fnc main() -> Int32
    {
        const client: OidcClient = OidcClient::new(
            "https://accounts.google.com",
            "https://accounts.google.com/o/oauth2/v2/auth",
            "https://oauth2.googleapis.com/token",
            "https://www.googleapis.com/oauth2/v3/certs",
            "my-client-id",
            "my-client-secret",
            "https://myapp.example.com/callback"
        )

        const req: OAuth2AuthorizeRequest = client.buildAuthorizeUrl("openid email")
        println("redirect user to: " + req.url)

        // Callback handler, after the provider redirects back with ?code=...
        const tokens: OidcTokenResponse = client.exchangeCode("the-code-from-callback", req.codeVerifier)
        if (tokens.ok)
        {
            // id_token signature + iss/aud/exp/nbf already verified here
            println("subject: " + tokens.claims["sub"].getString())
        }
        else
        {
            println("login failed: " + tokens.errorMessage)
        }
        return 0
    }
}

Turnkey web login

import tinox.core.oidc
import tinox.core.http_server

class Main
{
    fnc main() -> Int32
    {
        const client: OidcClient = OidcClient::new(
            "https://accounts.google.com",
            "https://accounts.google.com/o/oauth2/v2/auth",
            "https://oauth2.googleapis.com/token",
            "https://www.googleapis.com/oauth2/v3/certs",
            "my-client-id",
            "my-client-secret",
            "https://myapp.example.com/callback"
        )
        const webApp: OidcWebApp = OidcWebApp::new(client, "a-long-random-cookie-sealing-secret")

        const server: HttpServer = HttpServer::new(8080)
        webApp.install(server) // registers /login and /callback

        server.get("/", ctx => {
            if (!webApp.requireLogin(ctx))
            {
                return // already redirected to /login
            }
            const user: Map<String, JsonValue> = webApp.currentUser(ctx)
            ctx.response.text("Welcome, " + user["email"].getString())
        })

        server.listen()
        return 0
    }
}

class OidcClient

Fields

Methods

@Errorclass OidcError

* Invalid OIDC configuration, token or session.

Fields

class OidcTokenResponse

Fields

class OidcWebApp

Fields

Methods

class Session

Fields

Methods

class SessionManager

Fields

Methods