OidcAuthorizationState
The per-attempt secrets an OIDC auth-code + PKCE flow must round-trip through the user’s session between the authorization redirect and the callback: the CSRF-style state, the PKCE code_verifier, and the OIDC nonce (replay/injection protection for the ID token).
Synopsis
Section titled “Synopsis”final class OidcAuthorizationState
| Since | 1.0.0 |
| Source | OidcAuthorizationState.php |
Constructor
Section titled “Constructor”__construct()
Section titled “__construct()”public function __construct(string $state, string $pkceVerifier, string $nonce): mixed
The OIDC nonce sent in the authorization request, expected back in the ID token.
| Parameter | Type | Description |
|---|---|---|
$state | string | The CSRF-style state value sent to and echoed back by the authorization server. |
$pkceVerifier | string | The PKCE code_verifier (S256 challenge was derived from this). |
$nonce | string | The OIDC nonce sent in the authorization request, expected back in the ID token. |
Returns mixed
Methods
Section titled “Methods”| Method | Description |
|---|---|
getNonce(): string | |
getPkceVerifier(): string | |
getState(): string |
getNonce()
Section titled “getNonce()”public function getNonce(): string
Returns string — The OIDC nonce.
getPkceVerifier()
Section titled “getPkceVerifier()”public function getPkceVerifier(): string
Returns string — The PKCE code_verifier.
getState()
Section titled “getState()”public function getState(): string
Returns string — The state value.