dahlia / hollo

Federated single-user microblogging software
https://docs.hollo.social/
GNU Affero General Public License v3.0
238 stars 16 forks source link

Support PKCE for OAuth #44

Open ThisIsMissEm opened 1 month ago

ThisIsMissEm commented 1 month ago

Currently we don't support PKCE as introduced in Mastodon v4.3.0, as noted in #3.

In order to support this, we likely would want to re-work the current database structure and create proper access grants and access token records, since you need to store the PKCE challenge and challenge method with the access grant, and then verify it in the code for token exchange if present.