The false option of the pkceMethod init parameter for the JavaScript adapter is ignored

[mstichweh]

Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

adapter/javascript

Describe the bug

Since version 24 where "S256" is the default for the PKCE method, it can not be disabled anymore. Even the new false option does not have any effect. So "S256" is always set as PKCE method.

Version

24.0.1

Regression

• The issue is a regression

Expected behavior

It should be again possible to disable PKCE by setting the pkceMethod option to false, as described within the documentation.

Actual behavior

The false option of the pkceMethod init parameter is ignored. The check for false is missing in the source code:

if (initOptions.pkceMethod) {
    if (initOptions.pkceMethod !== "S256") {
        throw new TypeError(`Invalid value for 'pkceMethod', expected 'S256' but got '${initOptions.pkceMethod}'.`);
    }
    kc.pkceMethod = initOptions.pkceMethod;
} else {
    kc.pkceMethod = "S256";
}

It should be:

if (initOptions.pkceMethod) {
    if (initOptions.pkceMethod !== "S256") {
        throw new TypeError(`Invalid value for 'pkceMethod', expected 'S256' but got '${initOptions.pkceMethod}'.`);
    }
    kc.pkceMethod = initOptions.pkceMethod;
} else if (initOptions.pkceMethod !== false) {
    kc.pkceMethod = "S256";
}

How to Reproduce?

1. Create a new Keycloak JavaScript adapter
2. Provide false for the pkceMethod option when calling the init method
3. For example call the createLoginUrl method
4. The resulting URL will include the parameter code_challenge_method=S256 but it should not

Anything else?

No response

[jonkoops]

Thanks for the report @mstichweh. I've created a PR to resolve this issue (#28347). Is there any practical reason why you would want to not have PKCE enabled?

[mstichweh]

Thanks for the PR! I'm currently working on a Capacitor login solution and so doing the Access Token exchange by hand with a POST request. In the moment it seems to be the easier way to disable PKCE, but it still do not work, so we will see what the final solution will be ;-)