inbuxa/inbuxa-admin
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 22 Wiki Activity Sponsor

Sign in with S256 PKCE over plain HTTP too #112

Merged
jcoffey-dev merged 1 commits from fix/pkce-s256-always into main 2026-10-18 21:54:08 +00:00
Conversation 0 Commits 1 Files Changed 4
+140 -15
1 Commits
Author SHA1 Message Date
jcoffey-dev c390cec026 Sign in with S256 PKCE over plain HTTP too
ci / build (pull_request) Skipped
Details
ci / publish (pull_request) Skipped
Details
ci / notices (pull_request) Successful in 53s
Details
github/ci (branch) GitHub Actions
Details
ci / github (pull_request) Successful in 1m45s
Details 
Browsers leave out crypto.subtle on pages served over plain HTTP, and
sign-in then fell back to the plain PKCE method, sending the verifier
itself as the challenge. The challenge now comes from our own SHA-256
in that case, so it is always S256. The server advertises only S256,
and will refuse plain.
 2026-10-18 14:40:44 -07:00