tonyxu-io/pkce-generator

Code Verifier and Code Challenge Generator for OAuth with PKCE

PKCE Generator

An online tool to generate code verifier and code challenge for OAuth with PKCE.

URL: https://tonyxu-io.github.io/pkce-generator/

Reference: rfc-7636

Author: Tony Xu

Contributors:

• Felix Linker

pkce-generator's Issues

Code verifier and code challenge terms need to be interchanged

Hi @tonyxu-io,

First of all thanks a lot for hosting this tool. It makes life so much easier when testing the PKCE flows.

When a read through https://tools.ietf.org/html/rfc7636, a small question came into my mind. In the tool,

The code challenge seems to be a 43 character random string and the code verifier is the base64URLencoded value of the sha256 hash of the code challenge.

However, the spec https://tools.ietf.org/html/rfc7636 defines the two terms/names in the opposite way.

ie. code verifier is the 43 - 128 character random string (https://tools.ietf.org/html/rfc7636#section-4.1)

code challenge is the transformation of the code verifier (https://tools.ietf.org/html/rfc7636#section-4.2)

Is this understanding correct? Should we fix the interchange the name of the two values in tool?

Code verifier too short

Your code is not generating a code verifier that is long enough, the RFC requiers a minimum of 43 characters.

code_verifier = high-entropy cryptographic random STRING using the
unreserved characters [A-Z] / [a-z] / [0-9] / “-” / “.” / “_” / “~”
from Section 2.3 of [RFC3986], with a minimum length of 43 characters
and a maximum length of 128 characters.

Thank you!

I just wanted to let you know that this project helped me understand the RFC https://tools.ietf.org/html/rfc7636#appendix-A and figure out what was wrong with my pkce generator. Thank you so much!