The library documents itself · Security & governance
stzOidcClient
18 own methods · 5 forms written with extensions, listed under their method
the source: base/security/stzOidc.ring(opens in a new tab) · All classes · The area reference: Security & governance
Under each method, its extensions (Q CS XT Z ZZ IB W U): bold and ticked, it exists; struck, it does not. The extensions and what they mean
No method of this class is run on this page: the class reaches files, the network, processes, the clock, chance or sound, and an example run here would only be an example of its effects. Each method carries the explanation the library gives of itself.
Method
Explanation, as the source carries it
init
(no comment in the source: the name reads as a sentence) initno extension
Issuer
configuration (plain + Q twins)no extension
ClientId
(no comment in the source: the name reads as a sentence) client idno extension
SetRedirectUri
(no comment in the source: the name reads as a sentence) set redirect uriQCSXTZZZIBWU
RedirectUri
(no comment in the source: the name reads as a sentence) redirect urino extension
SetClockSkew
(no comment in the source: the name reads as a sentence) set clock skewQCSXTZZZIBWU
ClockSkew
(no comment in the source: the name reads as a sentence) clock skewno extension
AddKey
the provider's signing keys (its JWKS) -------------------------- add one key: [ :kid, :kty, :x, :y ] (EC) or [ :kid, :kty, :n, :e ] (RSA).QCSXTZZZIBWU
SetJwks
load a whole JWKS document ({"keys":[ {...}, ... ]}), as fetched from the provider's jwks_uri.QCSXTZZZIBWU
NumberOfKeys
(no comment in the source: the name reads as a sentence) number of keysno extension
KeyIds
(no comment in the source: the name reads as a sentence) key idsno extension
AuthorizationUrl
step 1: send the user to the provider --------------------------- The authorization URL. state defends the redirect against CSRF; nonce binds the id-token to THIS login (replay defense); PKCE (S256) stops an intercepted authorization code from being redeemed by anyone else.QCSXTZZZIBWU
NewPkce
a fresh PKCE verifier (kept by the app) and its S256 challenge (sent to the provider) -> [ :verifier, :challenge ].no extension
PkceChallengeOf
(no comment in the source: the name reads as a sentence) pkce challenge ofno extension
VerifyIdToken
step 2: believe (or refuse) the id-token ------------------------ Verify an id-token end to end -> [ :ok, :subject, :email, :claims, :why ]. pcExpectedNonce is the nonce this login sent ("" skips that check, which is only sound for a flow that carried no nonce).no extension
VerifyIdTokenAt
(no comment in the source: the name reads as a sentence) verify id token atno extension
Why
why the last verification was refused ("" when it passed).no extension
Show
(no comment in the source: the name reads as a sentence) showno extension