# Gitea OIDC compatibility

Gitea is configured as an OpenID Connect confidential client, with a client secret and an exact registered redirect URI. Some clients omit PKCE and nonce in authorization-code requests.

Default policy remains PKCE S256 plus an OIDC nonce. For a specific legacy confidential client, an administrator can open “应用接入 → 编辑”, or its developer can open “我的应用 → 编辑配置”, enable “传统 OIDC 客户端兼容（不发送 PKCE / nonce）”, and save. The database-backed option applies immediately without changing server environment variables or restarting the API. This is not a public-client setting.

The exception only applies when the application is confidential and has a stored secret hash. Missing PKCE is accepted only if both challenge fields are absent. Any supplied challenge still requires a matching verifier. A missing nonce is accepted for these clients, but a short supplied nonce remains invalid. Client secret verification, exact redirect matching, authorization code expiry, single use, session validity and scope checks remain active. Disabling the option restores the default policy and also rejects outstanding non-PKCE codes. `OAUTH_LEGACY_CONFIDENTIAL_CLIENT_IDS` remains available only as a transition fallback for older deployments.

Regression coverage: `TestLegacyOAuthPKCEBoundaries` and `TestLegacyConfidentialOAuthIntegration`. The latter uses an isolated temporary PostgreSQL schema and verifies the default deny policy, allowlisted authorization, bad redirect rejection, short nonce rejection, wrong-secret rejection, token exchange, replay rejection and public-client rejection.

Changing a Gitea authentication-source name changes its callback path. Copy the actual redirect URI, including percent-encoded Chinese characters, rather than replacing the path with a guessed English name.