Check PCKE only for Authorization code flow

go-oauth2 / oauth2

OAuth 2.0 server library for the Go programming language.

https://pkg.go.dev/github.com/go-oauth2/oauth2/v4

MIT License

3.31k stars 563 forks source link

Check PCKE only for Authorization code flow #175

Closed ajpetersons closed 3 years ago

ajpetersons commented 3 years ago

ForcePKCE config parameter should only be taken into account for Authorization Code flow. Currently other flows (Client Credentials, etc) will fail token creation if ForcePKCE is set to true.

Fixes https://github.com/go-oauth2/oauth2/issues/172