search

google / oauth2l

oauth2l ("oauth tool") is a simple CLI for interacting with Google API authentication.
Apache License 2.0
643 stars 81 forks source link

Use Proof Key for Code Exchange with SHA-256 #110

Closed DemiMarie closed 2 years ago

DemiMarie commented 3 years ago

This is a prerequisite for #37, as otherwise oauth2l would be vulnerable to a local information leak attack in certain (rare) scenarios.

andyrzhao commented 2 years ago

OAuth2 golang core lib has just been updated to support PKCE params in the auth handler interface here: https://github.com/golang/oauth2/pull/568. Need one more PR to update oauth2l to use the new PKCE interface. #37 is currently being worked on independently. Both issues should be resolved by end of Q2 2022.

andyrzhao commented 2 years ago

PKCE integration added in #136