oidcrp: the browser-facing half of OIDC for Go

Several small Go services needed the same OpenID Connect login flow, but they did not need a framework to own their sessions or application structure. oidcrp factors out that browser-facing protocol work and leaves the rest with the application.

A narrow boundary

The package handles provider discovery, the authorization-code flow with PKCE, state and nonce cookies, ID-token verification, and subject, email, or group allowlists. It also registers login and callback routes and provides middleware decisions for browser pages and API paths.

Local session storage remains an application concern. A small SessionManager interface asks the host service to validate, issue, and clear its own sessions. That keeps oidcrp usable whether the application chooses signed cookies, a database-backed session, or something else entirely.

Why keep it separate?

OIDC is easy to implement almost correctly. Reusing one reviewed flow avoids repeating security-sensitive cookie, nonce, callback, and token-verification code across every internal web UI. At the same time, the narrow interface avoids coupling those services to an all-purpose authentication framework.

The result is intentionally modest: a relying-party helper for Go applications authenticating humans through an OIDC provider, not an identity provider and not a session store.

Source and documentation: github.com/kilo666mj/oidcrp.