https://medplum.com logo
Join Discord
Powered by
any updates?
# general
y
any updates?
r
Hi Yury, Looking at the SMART App specification, it seems like 
code_verifier
is a required field for the token endpoint: https://build.fhir.org/ig/HL7/smart-app-launch/app-launch.html#obtain-access-token The SMART app launch spec recommends PKCE code verification to avoid code injection attacks
y
r
@yury.starav - we have created a task to track this issue - let me know how it looks to you https://github.com/medplum/medplum/issues/1486
a
SMART App Launch introduced the PKCE requirement in Smart App Launch v2, so servers that have implemented v1 may not use PKCE.
Note that some Smart App Launch v1 server implementations have included PKCE and require its use by clients. For ONC (g)(10) cert, ONC specifically said that is ok from a cert perspective for SMART v1 certified systems to include this constraint on clients, even though it’s not part of that version of the spec (see g10 CCG)
r
Thanks for this context @arscan - we did our live testing and did not certify for v1 - only v2.
y
Do you have estimations for updation?
r
Apologies @yury.starav - we do not at this instant.
y
@cody When I make pkceOptional in client settings I am getting -> the error: Invalid additional property "pkceOptional"
c
Hi @yury.starav - this should be fixed. Can you try again? (Medplum supports 2 different types of data validation. All new projects use "strict" mode. Some older projects used a looser form of data validation based on 
fhir.schema.json
from the FHIR spec. It looks like your project is on that older form of validation, and the 
pkceOptional
was not added correctly. We added 
pkceOptional
to 
fhir.schema.json
. If you'd like, we can also change your project to use strict mode.)
y
I updated our client with 
PKCE Optional
= 
true
and I still see that when we send request it returns that verifier code is required
Response: {\"error\":\"invalid_request\",\"error_description\":\"Missing code verifier\"}
@cody what's the different will be for us if you will migrate us to 
strict
mode?
I tried to make the calls with false and true values -> the same code_verifier is required
@cody any updates? I already tested our integration with Cerner and EPIC and it works from our side without PKCE
r
Yury - just sent you a DM, will take offline and will connect shortly
y
ok, some updates here sooner or later we will implement and integrate PKCE and I will let you know how the integration works
r
Appreciate that!
y
Some EHR systems like Cerner even does not support PKCE at all https://fhir.cerner.com/authorization/#:~:text=NOTE%3A%20Cerner's%20Authorization%20Server%20does,of%20the%20native%20applications%20BCP.
c
Hi @yury.starav - we'll get this out in the next 1-2 days: https://github.com/medplum/medplum/pull/1621
y
cool thank you for update
@cody it works now! Thank you!
Do you know if smart-configuration "code_challenge_methods_supported":[ "S256" ] is required field if PKCE is required or not?
183 Views
PreviousNext
Powered by