OAuth authorization code with client secret and PKCE #9739
Closed
jason-chan-lf
started this conversation in
Ideas
Replies: 1 comment
|
After upgrading to version 1.64.0 this seems to have already been supported. Thanks. Closing this. |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hi, I noticed when using the OAuth authorization code authentication type, the client secret option disappears when using PKCE. It would be great if both client secret and PKCE could be used together.
In the RFC 9700 Best Current Practice for OAuth 2.0 Security, it mentions "For confidential clients, the use of PKCE is RECOMMENDED".
https://datatracker.ietf.org/doc/html/rfc9700#section-2.1.1
Some screenshots from the example docs site
https://docs.scalar.com/swagger-editor#description/introduction
Without PKCE, client secret can be filled in
With PKCE, no client secret can be filled in
All reactions