search

thephpleague / oauth2-server

A spec compliant, secure by default PHP OAuth 2.0 Server
https://oauth2.thephpleague.com
MIT License
6.52k stars 1.12k forks source link

Prevent PKCE Downgrade Attack #1326

Closed Sephster closed 1 year ago

Sephster commented 1 year ago

This PR prevents a potential PKCE downgrade attack by rejecting access token requests that contain a code_verifier but have not been bound to a code_challenge as per internet draft OAuth 2.0 Security Best Current Practice