Why does the library require client_secret even when using PKCE?

[JaneJeon]

I understand that most people will simply use Authorization Code flow w/ client id + secret, but the PKCE extension + RS256 exists for a reason and my OCD just can't accept the fact that I have to inject the client secret (ugh).

I'm sure you're much more aware of the OIDC protocol than I am, but it IS pretty obvious that the Authorization Code + PKCE is widely regarded & used as a way to securely implement OIDC RP without exposing (or even using the client secret).

If you don't want to budge, I understand, but could you at least show me a way I can rely on client_secret-less Authorization Code flow w/ PKCE?

Thanks

Edit

But honestly, I think this is a bug, and that client_secret should be optional when params.code_challenge is set, especially considering I have already tested it to be working with https://github.com/IdentityModel/oidc-client-js

Edit 2

In fact, when I just set client_secret to some random value, such as YOU DON'T NEED CLIENT SECRET WHEN YOU'RE USING PKCE, my code already works! So I definitely think it should be optional in that case.

[panva]

Why does the library require client_secret even when using PKCE?

It doesn't. Use of PKCE has no impact on what client authentication mechanism the client uses. All it takes is to configure your client's token_endpoint_auth_method.

[JaneJeon]

Hmm, I’ll investigate my IdP further and report back.

[panva]

This is both client and server side configuration that should be in sync.

[JaneJeon]

Setting it to "none" worked. In fact, it's the ONLY configuration that makes sense given that I'm not sending any sort of client secret or cert to the endpoint.

Issue solved, but would love for this to be documented for anyone who's trying to do AC flow secret-less :) Thanks