lepture / authlib

The ultimate Python library in building OAuth, OpenID Connect clients and servers. JWS,JWE,JWK,JWA,JWT included.
https://authlib.org/
BSD 3-Clause "New" or "Revised" License
4.39k stars 436 forks source link

rfc7636: validate code challenge format #638

Closed amCap1712 closed 3 months ago

amCap1712 commented 3 months ago

Section 4.2 of RFC 7636 mentions the ABNF form to which the code challenge should adhere. authlib currently accepts any string in code_challenge without validating if it matches the format specified in the RFC. Fix the same and also update relevant tests.

What kind of change does this PR introduce? (check at least one)