search

dart-lang / tools

This repository is home to tooling related Dart packages.
BSD 3-Clause "New" or "Revised" License
30 stars 21 forks source link

AuthorizationCodeGrant with PKCE should be optional #360

Open czepiec opened 3 years ago

czepiec commented 3 years ago

I think adding code_challenge and code_challenge_method to the URL query should be optionally disabled. Authorization Code Grant with PKCE is recommended so that it can be enabled by default, but the flow without the PKCE is a valid OAuth2 standard.

This comes in handy if you only want to get the authorization code and send it to your APIs, which continue the OAuth2 flow (use as a web application).

amsgo commented 3 years ago

I would like to second on this request. I am currently working with an API that does not properly support PKCE, so I had to create my own fork of the package to make it work. I would be handy, if I could just have an optional boolean parameter to disable PKCE when constructing my AuthorizationCodeGrant.

khal-it commented 3 years ago

Agree! Had the same problem with Salesforce...

JGM-edu commented 4 months ago

I had the same issue as amsgo and khal-it with splits.io. I've opened a PR for it, here's hoping. dart-lang/oauth2#175