Pull request (OPEN) · PR #1009 fix(endpoint-auth): refuse incomplete or plain PKCE parameters · @rmdes
Fixes #1008
PKCE stays optional, but once either parameter is given the request needs both, and the method must be S256. Otherwise the endpoint shows the usual missing parameter or invalid value error. Three tests, each failing (302 to the consent screen) before the change.