OidcStateEntry
in package
The tuple an {@see OidcStateStoreInterface} holds for one in-flight login.
$codeVerifier stays Sensitive while stored (§12.5: the verifier is secret for
its whole lifetime, "including … in any OidcStateStore entry"), so a store
implementation that needs to persist the value at rest (e.g. a Redis-backed store)
must call ->reveal() explicitly and is then responsible for protecting it.
Table of Contents
Properties
- $codeVerifier : Sensitive
- $nonce : string
- $redirectUri : string
- $returnTo : string|null
- $state : string
Methods
- __construct() : mixed
Properties
$codeVerifier read-only
public
Sensitive
$codeVerifier
$nonce read-only
public
string
$nonce
$redirectUri read-only
public
string
$redirectUri
$returnTo read-only
public
string|null
$returnTo
= null
$state read-only
public
string
$state
Methods
__construct()
public
__construct(string $state, string $nonce, Sensitive $codeVerifier, string $redirectUri[, string|null $returnTo = null ]) : mixed
Parameters
- $state : string
-
The
statevalue this entry is keyed by. Not a secret (§12.3 rule 2). - $nonce : string
-
The
nonceto check the ID token'snonceclaim against. Not a secret (§12.3 rule 2). - $codeVerifier : Sensitive
-
The PKCE verifier for the matching authorization request (§12.5 secret).
- $redirectUri : string
-
The
redirect_urithat was sent on the authorization request and must be replayed on exchange. - $returnTo : string|null = null
-
Optional application-owned data, e.g. the page the user was heading to before login.