Accept only S256 PKCE challenges #205

Merged

jcoffey-dev merged 1 commits from fix/pkce-s256-only into main

2026-10-18 22:21:28 +00:00

Author	SHA1	Message	Date
jcoffey-dev	9c856d3c66	Accept only S256 PKCE challenges ci / fork-checks (pull_request) Skipped Details ci / build (pull_request) Skipped Details github/ci (branch) GitHub Actions Details ci / github (pull_request) Successful in 20m46s Details The authorization endpoint took the plain method, and assumed it when a challenge came without a method (RFC 7636's default), for every client but stateless ones, though the metadata lists only S256. With plain the challenge is the verifier, so it protects nothing. Codes issued with plain before an upgrade still verify.	2026-10-18 14:50:04 -07:00

Author

SHA1

Message

Date

jcoffey-dev

9c856d3c66

Accept only S256 PKCE challenges

ci / fork-checks (pull_request) Skipped

Details

ci / build (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 20m46s

Details

The authorization endpoint took the plain method, and assumed it when a
challenge came without a method (RFC 7636's default), for every client
but stateless ones, though the metadata lists only S256. With plain the
challenge is the verifier, so it protects nothing. Codes issued with
plain before an upgrade still verify.

2026-10-18 14:50:04 -07:00