Skip to content

deprecate pkce plain method#248

Open
aaronpk wants to merge 1 commit into
mainfrom
issue-236
Open

deprecate pkce plain method#248
aaronpk wants to merge 1 commit into
mainfrom
issue-236

Conversation

@aaronpk
Copy link
Copy Markdown
Member

@aaronpk aaronpk commented May 4, 2026

closes #236

Comment thread draft-ietf-oauth-v2-1.md
"code_challenge_method":
: OPTIONAL, defaults to `plain` if not present in the request. Code
verifier transformation method is `S256` or `plain`.
: OPTIONAL, defaults to `S256` if not present in the request.
Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@panva I'd be curious for your perspective on this change. I wasn't sure whether we wanted to make the parameter required now, or default to the only defined method.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@aaronpk It feels like making it required is a breaking change but in light of the original default being unavailable it isn't. I'd make it required rather than introducing variable defaults.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Consideration to forbid PKCE plain mode in OAuth 2.1

2 participants