Support PKCE Flow

[davidvuckovic]

Describe the problem you'd like to have solved

What I'm trying to do, is follow the PKCE flow. Meaning I have code_verifier, code_challenge and code_challenge method. What I can do currently is add custom parameters to authorize url. This makes it easy to add code challenge and code challenge method. However, when it comes to using the code_verifier string, the API doesn't really appear to support this. AuthApi.exchangeCode seems to be pretty deadset about the parameters it can send. Meaning I cannot shove a code_verifier in there. The Auth0 request therefore returns a 400 -> missing code_verifier.

Describe the ideal solution

The ideal solution would be a way to work around the request that is actually sent there. Extra parameters, etc.

Alternatives and current work-arounds

I cannot think of a workaround.

Additional information, if any

Using code basically as is from the readme.

       AuthenticationController authController = AuthenticationController.newBuilder(domain, clientId, clientSecret) .build();            
      String authorizeUrl = authController.buildAuthorizeUrl(httpRequest, httpResponse, redirectUri).build()
      ....
      Tokens tokens = authController.handle(httpRequest, httpResponse);

https://oauth.net/2/pkce/ mentions:

PKCE is not a replacement for a client secret, and PKCE is recommended even if a client is using a client secret.

Note: Because PKCE is not a replacement for client authentication, it does not allow treating a public client as a confidential client.

PKCE was originally designed to protect the authorization code flow in mobile apps, but its ability to prevent authorization code injection makes it useful for every type of OAuth client, even web apps that use a client secret.

I understand that PKCE, atleast according to Auth0 is meant for single page apps (meaning Angular, ReactJS etc.). But is it really unnecessary as a security measure if we can store a client secret?

[jimmyjames]

Hi @davidvuckovic, thanks for raising this. You are correct that this library does not currently support PKCE, but is on the roadmap to add support for.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. If you have not received a response for our team (apologies for the delay) and this is still a blocker, please reply with additional information or just a ping. Thank you for your contribution! 🙇‍♂️