Missing required PKCE code challenges should raise an error in the authorization endpoint

Description

The OIDC.SSO profile can be configured to require PKCE. Currently the OP plugin only verifies this in the token endpoint when the authorization code is being exchanged into id_token and access token. That's not compliant with the spec, as the authorization endpoint must already return authorization error response with specific details, if the code challenge is missing (see 4.4.1 in [1]).

[1] https://datatracker.ietf.org/doc/html/rfc7636

Environment

None

Activity

Show:

Henri MikkonenMarch 4, 2022 at 7:26 AM

A new SWF action ValidateCodeChallenge verifies PKCE parameters on authorize flow (front-channel) too. Code partly overlaps with the already existing ValidatePKCE action, but is that much different that combining these into a same action didn't feel best option either.

Fixed

Details

Assignee

Reporter

Fix versions

Created December 10, 2021 at 2:09 PM
Updated April 15, 2022 at 5:32 PM
Resolved March 4, 2022 at 7:26 AM

Flag notifications