Documentation
¶
Overview ¶
Package pkce checks a Proof Key for Code Exchange (RFC 7636), which ties a one-time code to the party that asked for it: the client sends a hash of a secret when it starts, and the secret itself when it redeems the code, so that a code intercepted on its way back -- by another app claiming the same URI scheme, say -- is worth nothing to whoever intercepted it.
Only S256. The "plain" method sends the secret where the hash should be, which defeats the point for exactly the interception it exists to stop.
Index ¶
Constants ¶
const MethodS256 = "S256"
MethodS256 is the one challenge method accepted.
Variables ¶
This section is empty.
Functions ¶
func ChallengeS256 ¶
ChallengeS256 is the S256 challenge for a verifier: base64url, without padding, of its SHA-256.
func MatchesS256 ¶
MatchesS256 reports whether a verifier is the one a challenge was made from. A verifier of the wrong shape never matches, whatever it hashes to.
func ValidChallenge ¶
ValidChallenge reports whether a challenge has the shape an S256 one has, so that one which could never be matched is refused when the flow starts rather than when it is about to finish.
func ValidVerifier ¶
ValidVerifier reports whether a verifier is 43 to 128 characters of the unreserved set.
Types ¶
This section is empty.
Source Files