PKCE support

[okta]

PKCE support

[aaronpk]

fwiw PKCE is not an alternative to a client secret and should always be included even for server-side apps with a client secret.

https://oauth.net/2/pkce/

https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-19#section-2.1.1

[Thialala]

I know that PKCE is primarly designed for Javascript and native apps. However, we would like to extend its use for our MVC Web Apps. Thus, we won't need a client secret anymore.

Currently, I'm using the following versions of .NET:

• ASP .NET MVC 5
• ASP .NET Core 2.2 and 3.0

Thanks!

[laura-rodriguez]

Hi @Thialala ,

Unfortunately, this package doesn't support PKCE.
What's your use case? What .NET version are you using?

[swimn10s]

Was this package ever updated to support Authorization Code + PKCE flow? We have a similar use case to @Thialala.

[laura-rodriguez]

Hi @swimn10s,

This package hasn't been updated yet.

Is PKCE a blocker for you?

[bryanapellanes-okta]

Closing due to inactivity. If this topic is of interest feel free to reopen for further discussion.