Issue ouverte · Issue #1004 Token request without code_verifier returns 500 · @rmdes
When a code was issued with a code_challenge, codeValidator in packages/endpoint-auth/lib/middleware/code.js calls verifyCode(code_verifier, code_challenge) whether or not code_verifier was sent. Without it, createHash().update(undefined) in lib/pkce.js throws ERR_INVALID_ARG_TYPE and the token endpoint answers 500.
The request is refused, but as a server error rather than a 400. Found with the IndieAuth test suite (S311), see #967.