PKCE

pkce

RFC7636 - Proof Key for Code Exchange (PKCE)

Specifies the PKCE configuration, such as a policy check on the required use of PKCE.

---

pkce.required

Configures if and when the authorization server requires clients to use PKCE. This helper is called whenever an authorization request lacks the code_challenge parameter. false allows the request to continue without PKCE, while true rejects it.

default value:

function required(ctx: KoaContextWithOIDC, client: Client): boolean {
  // All public clients MUST use PKCE as per
  // https://www.rfc-editor.org/info/rfc9700/#section-2.1.1-2.1
  if (client.clientAuthMethod === 'none') {
    return true;
  }
  const fapiProfile = ctx.oidc.isFapi('2.0', '1.0 Final');
  // FAPI 2.0 as per
  // https://openid.net/specs/fapi-security-profile-2_0-final.html#section-5.3.2.2-2.5
  if (fapiProfile === '2.0') {
    return true;
  }
  // FAPI 1.0 Advanced as per
  // https://openid.net/specs/openid-financial-api-part-2-1_0-final.html#authorization-server
  if (fapiProfile === '1.0 Final' && ctx.oidc.route === 'pushed_authorization_request') {
    return true;
  }
  // In all other cases use of PKCE is RECOMMENDED as per
  // https://www.rfc-editor.org/info/rfc9700/#section-2.1.1-2.2
  // but the server doesn't force them to.
  return false;
}

---