From 454bffe4bafe61d127620dac2da4540282f08914 Mon Sep 17 00:00:00 2001 From: XShine555 Date: Sun, 5 Jul 2026 23:01:44 +0200 Subject: [PATCH] feat(frontend): make Zitadel client secret optional (support PKCE apps) Configure openid-client with None auth (public client + PKCE) when no secret is provided, so both PKCE and confidential (Code) Zitadel web apps work. Co-Authored-By: Claude Opus 4.8 --- frontend/src/lib/server/auth.ts | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/frontend/src/lib/server/auth.ts b/frontend/src/lib/server/auth.ts index 79917f4..066f12c 100644 --- a/frontend/src/lib/server/auth.ts +++ b/frontend/src/lib/server/auth.ts @@ -25,13 +25,13 @@ export function getOidcConfig(): Promise { const issuer = new URL(env.ZITADEL_ISSUER); const options = issuer.protocol === 'http:' ? { execute: [client.allowInsecureRequests] } : undefined; - return client.discovery( - issuer, - env.ZITADEL_CLIENT_ID, - env.ZITADEL_CLIENT_SECRET, - undefined, - options - ); + + const secret = env.ZITADEL_CLIENT_SECRET; + const hasSecret = !!secret && !secret.startsWith('REPLACE_'); + + return hasSecret + ? client.discovery(issuer, env.ZITADEL_CLIENT_ID, secret, undefined, options) + : client.discovery(issuer, env.ZITADEL_CLIENT_ID, undefined, client.None(), options); })(); return configPromise; }