Hi everyone,

Do anyone write any documentation on PKCE implementation flow. I have not found that so I took some of the advantage of test/test_authorization_code.py file and I am using the following flow

import os

import requests
from hashlib import sha256
import base64
from urllib.parse import urlencode
from django.test import TestCase

client_id = '*******'
client_secret = '********'
redirect_uri = 'https://6c5b3b6c.ngrok.io/misc/hello/'

def base64URLEncode(random_bytes):
    return base64.urlsafe_b64encode(random_bytes)

def usha256(buffer):
    return sha256(buffer).digest()

secret_data = b'cr7'
random_chars = os.urandom(32)
verifier = base64URLEncode(secret_data).rstrip(b'=')
code_challenge = base64URLEncode(usha256(verifier)).rstrip(b'=')
code_challenge_method = "S256"
scope = 'openid'
params = {
    'client_id': client_id,
    'redirect_uri': redirect_uri,
    'response_type': 'code',
    #'scope': scope,
    'code_challenge': code_challenge,
    'code_challenge_method': code_challenge_method
}
qstr = urlencode(params)
print('https://6c5b3b6c.ngrok.io/o/authorize/?' + qstr)
code = input('enter code obtained: ')

authorization_url = oauth_resp.url
headers = {'Content-type': 'application/x-www-form-urlencoded'}
token_url = 'https://6c5b3b6c.ngrok.io/o/token/'
data = {
    'code': code,
    'client_id': client_id,
    'client_secret': client_secret,
    'redirect_uri': redirect_uri,
    'grant_type': 'authorization_code',
    'code_verifier': verifier
}
token_resp = requests.post(token_url, data=data, headers=headers)
print(token_resp)

If I am not sending the code_verifier in the second call it still gets the access_token and other data. I need to restrict it , that if code verifier is not found or found wrong it should give an error. So I read somewhere and added this in my django app's settings.

OAUTH2_PROVIDER = {
    "PKCE_REQUIRED": True
}

But It has also not done the work correctly, can anyone help me to use PKCE flow with django-oauth-toolkit ?

Add PKCE Support #566

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions