Ayato c51628ea27 feat(op): always verify code challenge when available (#721) ... Finally the RFC Best Current Practice for OAuth 2.0 Security has been approved. According to the RFC: > Authorization servers MUST support PKCE [RFC7636]. > > If a client sends a valid PKCE code_challenge parameter in the authorization request, the authorization server MUST enforce the correct usage of code_verifier at the token endpoint. Isn’t it time we strengthen PKCE support a bit more? This PR updates the logic so that PKCE is always verified, even when the Auth Method is not "none".		2025-03-24 18:00:04 +02:00
..
client.go	feat(op): Add response_mode: form_post (#551)	2024-03-05 15:04:43 +02:00
oidc.go	feat(op): always verify code challenge when available (#721)	2025-03-24 18:00:04 +02:00
storage.go	docs(example): fixed creation of refresh token (#711)	2025-02-19 14:44:34 +02:00
storage_dynamic.go	feat(deps): update go-jose to v4 (#588)	2024-04-11 18:13:30 +03:00
token.go	docs(example): simplified deletion (#699)	2025-02-13 11:26:00 +00:00
user.go	feat(example): Allow configuring some parameters with env variables (#663)	2024-10-21 20:59:28 +02:00
user_test.go	feat(example): Allow configuring some parameters with env variables (#663)	2024-10-21 20:59:28 +02:00