VibeNest Auth

OpenID Connect Authorization Code flow with mandatory PKCE for applications deployed on VibeNest.

Security contract

Use discovery and a maintained OIDC client library. Validate state, nonce, PKCE, signature, issuer, audience and expiry. Create an application-owned HTTP-only server session from the verified pairwise sub.

Never use email as primary identity, accept a browser-supplied userId, copy the dashboard cookie, or store access/ID tokens in localStorage.

Next.js App Router

Use server-only Route Handlers with openid-client 6.x, one-shot pending state and an opaque HTTP-only application session. Checkout and paid routes derive buyer_subject only from that session.

Immediately after await oidc.discovery(...), explicitly enable ID-token signature verification:

oidc.enableNonRepudiationChecks(config);

Call it before oidc.authorizationCodeGrant(...). The grant helper alone does not enable JWS ID-token signature checking in openid-client 6.x.

Node / Express

Use openid-client with a durable PostgreSQL/Redis session store. Regenerate the session after callback and destroy it on local logout.

Immediately after await oidc.discovery(...), explicitly enable ID-token signature verification:

oidc.enableNonRepudiationChecks(config);

Call it before oidc.authorizationCodeGrant(...). The grant helper alone does not enable JWS ID-token signature checking in openid-client 6.x.

ASP.NET Core

Use the built-in OpenID Connect handler with response type code, UsePkce=true, SaveTokens=false, and a persistent Data Protection key ring for the local cookie session.

Complete copy-paste references live in docs/vibenest-auth/ in the VibeNest repository.