PCKE not enforced
🏬Self-hosted🔍Authentication⛓️💥APIs❓Question🔗OIDC
I created an app with the Authentication Code flow and PCKE enabled.
Here's the summary as displayed by the wizard:
The problem is, I can log in and exchange the code for tokens without ever specifying
The only way to effectively enforce PCKE it is to include
I'm not sure if this is relevant, but the summary screen shows the following for various Authentication Methods:
PCKE: None
CODE: Basic
JWT: Private Key JWT
POST: Post
Shouldn't Zitadel enforce PCKE parameters in the login request if the app is configured to use it?
Here's the summary as displayed by the wizard:
The problem is, I can log in and exchange the code for tokens without ever specifying
code_challengecode_challenge/code_challenge_methodcode_challenge_method/code_verifiercode_verifier.The only way to effectively enforce PCKE it is to include
code_verifiercode_verifier in the token endpoint request, in which case I get code_verifier unexpectedly providedcode_verifier unexpectedly provided.I'm not sure if this is relevant, but the summary screen shows the following for various Authentication Methods:
PCKE: None
CODE: Basic
JWT: Private Key JWT
POST: Post
Shouldn't Zitadel enforce PCKE parameters in the login request if the app is configured to use it?
