Stricter security. Moved to /auth/oidc/

paskia/fastapi/oid.py

@@ -33,16 +33,11 @@ def _get_issuer(request: Request) -> str:
     return f"{scheme}://{host}"
 
 
-def _verify_pkce(code_verifier: str, code_challenge: str, method: str) -> bool:
-    """Verify PKCE code_verifier against stored code_challenge."""
-    if method == "plain":
-        return code_verifier == code_challenge
-    elif method == "S256":
-        # SHA256 hash, base64url encode
-        digest = hashlib.sha256(code_verifier.encode("ascii")).digest()
-        computed = base64.urlsafe_b64encode(digest).rstrip(b"=").decode("ascii")
-        return computed == code_challenge
-    return False
+def _verify_pkce(code_verifier: str, code_challenge: str) -> bool:
+    """Verify PKCE code_verifier against stored code_challenge (S256 only)."""
+    digest = hashlib.sha256(code_verifier.encode("ascii")).digest()
+    computed = base64.urlsafe_b64encode(digest).rstrip(b"=").decode("ascii")
+    return computed == code_challenge
 
 
 def _parse_client_credentials(
@@ -147,8 +142,16 @@ async def token(
                 },
                 status_code=400,
             )
-        method = auth_code.code_challenge_method or "plain"
-        if not _verify_pkce(code_verifier, auth_code.code_challenge, method):
+        method = auth_code.code_challenge_method or "S256"
+        if method != "S256":
+            return JSONResponse(
+                {
+                    "error": "invalid_grant",
+                    "error_description": "Only S256 code_challenge_method is supported",
+                },
+                status_code=400,
+            )
+        if not _verify_pkce(code_verifier, auth_code.code_challenge):
             return JSONResponse(
                 {
                     "error": "invalid_grant",