OAuth2: PKCE(Proof Key for Code Exchange)

[zhaohuabing]

This PR introduces support for PKCE(Proof Key for Code Exchange) in the OAuth2 filter. This enhancement mitigates the risk of the authorization code interception attacks.

Background: https://oauth.net/2/pkce/
RFC: Proof Key for Code Exchange by OAuth Public Clients

Commit Message:
Additional Description:
Risk Level: low
Testing: unit and integrate test, also manually tested with AWS cognito
Docs Changes:
Release Notes: Yes
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #35230]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional API Considerations:]

CC @missBerg @arkodg @denniskniep

[repokitteh-read-only]

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/).
envoyproxy/api-shepherds assignee is @wbpcode
CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).

🐱

Caused by: #37849 was opened by zhaohuabing.

see: more, trace.

[zhaohuabing]

I prefer removing this switch and enabling PKCE by default, because the OAuth 2.0 [RFC6749] server responses are unchanged by the PKCE specification, client implementations of this specification do not need to know if the server has implemented this specification or not and SHOULD send the additional parameters as defined in Section 4 to all servers.

This is recommend by rfc 7636: https://www.rfc-editor.org/rfc/rfc7636#section-5

[denniskniep]

Hi @zhaohuabing,
can´t we add a new parameter code_verifier to the asyncGetAccessToken method.
This is then used here:

envoy/source/extensions/filters/http/oauth2/filter.cc

Lines 467 to 468 in 2425431

	oauth_client_->asyncGetAccessToken(auth_code_, config_->clientId(), config_->clientSecret(),
	redirect_uri, config_->authType());

The parameter is set by validateOAuthCallback return value (CallbackValidationResult), which retrieves it from a newly introduced code_verifier cookie (http-only, secure).

envoy/source/extensions/filters/http/oauth2/filter.cc

Line 455 in 2425431

const CallbackValidationResult result = validateOAuthCallback(headers, path_str);

This newly introduced code_verifier cookie is set in the redirectToOAuthServer method.

[zhaohuabing]

@denniskniep Yes, you'r right about this. The asyncGetAcessToken is triggered by the IDP's redirect after user authentication, and we can retrieve the code verifier from the cookie. I missed that - thanks for pointing it out!