AuthorizationRequest
in package
The result of `oidcBegin` — everything the caller needs to start an authorization-code + PKCE login (CONTRACT.md §12.1).
The caller owns this state (§12.3 rule 1). The SDK stores nothing: it keeps no
copy of $state, $nonce or $codeVerifier in any implicit cache or process-global
state. Persist all three in your own HTTP session (or in an
OidcStateStoreInterface), redirect the browser to self::$url, and pass
$nonce + $codeVerifier back into oidcExchange when the authorization code arrives.
Table of Contents
Properties
- $codeVerifier : Sensitive
- $nonce : string
- $state : string
- $url : string
Methods
- __construct() : mixed
Properties
$codeVerifier read-only
public
Sensitive
$codeVerifier
$nonce read-only
public
string
$nonce
$state read-only
public
string
$state
$url read-only
public
string
$url
Methods
__construct()
public
__construct(string $url, string $state, string $nonce, Sensitive $codeVerifier) : mixed
Parameters
- $url : string
-
The fully-built authorization URL to redirect the browser to.
- $state : string
-
CSPRNG CSRF value (≥128 bits, base64url unpadded) to compare against the
statethe IdP returns. Not a secret (§12.3 rule 2). - $nonce : string
-
CSPRNG replay-protection value (≥128 bits) that must equal the ID token's
nonceclaim. Not a secret (§12.3 rule 2). - $codeVerifier : Sensitive
-
The PKCE verifier, secret for its whole lifetime (§12.5). Pass it back into
oidcExchange.