fix: add RFC 8414 pkce info to OpenID Connect Discovery (#2547)

Closes #2311
ory · Jun 3, 2021 · 9693168 · 9693168
1 parent 81e0784
commit 9693168
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 0 deletions.
diff --git a/oauth2/doc.go b/oauth2/doc.go
@@ -149,6 +149,10 @@ type WellKnown struct {
 	// the Request Object is passed by value (using the request parameter) and when it is passed by reference
 	// (using the request_uri parameter).
 	RequestObjectSigningAlgValuesSupported []string `json:"request_object_signing_alg_values_supported"`
+
+	// JSON array containing a list of Proof Key for Code Exchange (PKCE) [RFC7636] code challenge methods supported
+	// by this authorization server.
+	CodeChallengeMethodsSupported []string `json:"code_challenge_methods_supported"`
 }
 
 // swagger:parameters deleteOAuth2Token

diff --git a/oauth2/handler.go b/oauth2/handler.go
@@ -252,6 +252,7 @@ func (h *Handler) WellKnownHandler(w http.ResponseWriter, r *http.Request) {
 		FrontChannelLogoutSessionSupported:     true,
 		EndSessionEndpoint:                     urlx.AppendPaths(h.c.IssuerURL(), LogoutPath).String(),
 		RequestObjectSigningAlgValuesSupported: []string{"RS256", "none"},
+		CodeChallengeMethodsSupported:          []string{"plain", "S256"},
 	})
 }
 

diff --git a/oauth2/handler_test.go b/oauth2/handler_test.go
@@ -450,6 +450,7 @@ func TestHandlerWellKnown(t *testing.T) {
 		FrontChannelLogoutSessionSupported:     true,
 		EndSessionEndpoint:                     urlx.AppendPaths(conf.IssuerURL(), oauth2.LogoutPath).String(),
 		RequestObjectSigningAlgValuesSupported: []string{"RS256", "none"},
+		CodeChallengeMethodsSupported:          []string{"plain", "S256"},
 	}
 	var wellKnownResp oauth2.WellKnown
 	err = json.NewDecoder(res.Body).Decode(&wellKnownResp)