PKCE Support about node-openid-client

[panva]

Hi @davidgtonge,

I am much interested in the use-case where this applies to a confidential client that has a kept-secret. I can't think of a situation where PKCE would add any real value to such a client.

What about passing code_verifier as a property of checks and if it's present it would be added to the body that goes to the grant(...) call.

[davidgtonge]

Hi @panva apologies for the delay.
So in an earlier draft of the FAPI spec we had PKCE as required for confidential and public clients. We've now made it only required for public clients, however there is still a "defence in depth" argument for using it for confidential clients. Essentially it provides "Holder of Key" protection for the auth code. So the client is not just proving its identity with its client creds, but also proving that it was the client who started that particular authorization flow.

I also think it's nice to help people understand the specs :-)

I'll do a pull request to add it as an optional property of checks.

Thanks

[ingoncalves]

The Passport Strategy doesn't take the code_verifier param. I'll send a PR with this fix.