Description
Describe the problem you'd like to have solved
What I'm trying to do, is follow the PKCE flow. Meaning I have code_verifier, code_challenge and code_challenge method. What I can do currently is add custom parameters to authorize url. This makes it easy to add code challenge and code challenge method. However, when it comes to using the code_verifier string, the API doesn't really appear to support this. AuthApi.exchangeCode seems to be pretty deadset about the parameters it can send. Meaning I cannot shove a code_verifier in there. The Auth0 request therefore returns a 400 -> missing code_verifier.
Describe the ideal solution
The ideal solution would be a way to work around the request that is actually sent there. Extra parameters, etc.
Alternatives and current work-arounds
I cannot think of a workaround.
Additional information, if any
Using code basically as is from the readme.
AuthenticationController authController = AuthenticationController.newBuilder(domain, clientId, clientSecret) .build();
String authorizeUrl = authController.buildAuthorizeUrl(httpRequest, httpResponse, redirectUri).build()
....
Tokens tokens = authController.handle(httpRequest, httpResponse);
https://oauth.net/2/pkce/ mentions:
PKCE is not a replacement for a client secret, and PKCE is recommended even if a client is using a client secret.
Note: Because PKCE is not a replacement for client authentication, it does not allow treating a public client as a confidential client.
PKCE was originally designed to protect the authorization code flow in mobile apps, but its ability to prevent authorization code injection makes it useful for every type of OAuth client, even web apps that use a client secret.
I understand that PKCE, atleast according to Auth0 is meant for single page apps (meaning Angular, ReactJS etc.). But is it really unnecessary as a security measure if we can store a client secret?