How to set nonce in combination with response_type=code

[androa]

Our OIDC provider highly recommends setting state, nonce and PKCE. They will soon make it mandatory.

We use openid-client in conjuction with Passport and code as response_type, which is the only one supported by our identity provider.

When using Passport.authenticate() to initiate the login process. It does not allow us to pass on nonce to the underlying Strategy.

I see openid-client automatically sets nonce when using id_token as response_type, but with no other way to trigger that.

The only possible way I've found so far is to override the client.authorizationUrl() method, but that feels very heavy handed.

Is there a better way that I'm missing here?

[panva]

You can pass any parametere you like to the passport.authenticate() call. e.g.

passport.authenticate('oidc', { nonce: generators.nonce() })(req, res, next);

[androa]

🤦 That worked like a charm! Thank you for the very quick response.

Would love to mark your response as the correct answer, but GitHub is being very buggy at the moment, so it does not allow me :(