Issue ouverte · Issue #1008 Authorization endpoint accepts incomplete or plain PKCE parameters · @rmdes
The authorization endpoint decides whether to use PKCE with usePkce = code_challenge && code_challenge_method (packages/endpoint-auth/lib/controllers/authorization.js), and never checks the method. So three malformed requests go through to the consent screen instead of being refused:
code_challenge_method=plain: accepted, though the metadata only lists S256code_challenge_method=S256 without code_challenge: treated as a client not using PKCEcode_challenge without code_challenge_method: the sameThe second matters most: a challenge stripped from a real client’s request leaves a code that can be redeemed without a verifier.
Found with the IndieAuth test suite (S216, S221, S222): https://dev.indieauth.rocks/implementations/2, see #967.