Extension assignment

📝 Build an OIDC Relying Party on Cloudflare Workers

You’ve simulated the auth-code flow in the Academy and read a token in Practical 5. Now be the client: build a small app that signs users in through the Lab’s own OIDC provider, and validate the ID token yourself. This mirrors our internship assignments — the documentation is graded like the code, and you submit a GitHub Pull Request.

Need an invite?

Registering a client is invite-gated. Email akhil@integrauth.com for a code, then register your app under your account → Your apps. This assignment is Practical 7.

Requirements

Fetch the Lab’s configuration from /.well-known/openid-configuration — don’t hard-code endpoints.
Run the authorization-code flow with PKCE S256, a random state and a nonce. Send the user to the Lab’s authorization_endpoint (/authorize).
Exchange the code at /oidc/token (client_secret_post or HTTP Basic), form-encoded — never JSON.
Validate the id_token yourself against /.well-known/jwks.json: check iss, aud, exp, the ES256 signature and that nonce matches — no auth libraries for the core flow.
Call /oidc/userinfo with the access token and show the signed-in user.
Maintain your own session cookie after login, and implement logout.

Deliverables

A public GitHub repository with the Worker.
DECISIONS.md — the choices you made and why (the trade-offs, not just the what).
A High-Level Design doc with a Mermaid sequence diagram of the full login.
A README with run instructions (env vars, wrangler dev, how to register the client).
At least a few offline tests (no live network in the test run).

Submission

Open a Pull Request against the assignment repository (same flow as the internship): a clear title, a description linking your public repo, and the docs above in the PR. Reviewer: makhil006. Expect review comments the way you’d get them on real code — treat the docs as part of the deliverable, not an afterthought.

Grading rubric