oauth2

func GenerateVerifier ¶

func GenerateVerifier() string

GenerateVerifier generates a PKCE code verifier with 32 octets of randomness. This follows recommendations in RFC 7636.

A fresh verifier should be generated for each authorization. S256ChallengeOption(verifier) should then be passed to Config.AuthCodeURL and VerifierOption(verifier) to Config.Exchange.

func S256ChallengeFromVerifier ¶

func S256ChallengeFromVerifier(verifier string) string

S256ChallengeFromVerifier returns a PKCE code challenge derived from verifier with method S256.

Prefer to use S256ChallengeOption where possible.

func S256ChallengeOption ¶

func S256ChallengeOption(verifier string) []auth_code_option.AuthCodeOption

S256ChallengeOption returns AuthCodeOption values that set the PKCE code challenge and challenge method derived from verifier with method S256. The returned options should be passed to Config.AuthCodeURL only.

func TokenRequestCredentialFields ¶ added in v1.91.0

func TokenRequestCredentialFields() []string

TokenRequestCredentialFields are the fields of a token request that carry a credential: the client's secret or assertion (RFC 6749 section 2.3, RFC 7523), the grant's code, verifier, refresh token, assertion or password (RFC 6749 section 4, RFC 7636, RFC 7523) -- and the password grant's username, which names the person. They are what a log masks of one, keeping what says what was asked for: the grant type, the client id, the redirect URI and the scope.

func TokenResponseCredentialFields ¶ added in v1.91.0

func TokenResponseCredentialFields() []string

TokenResponseCredentialFields are the fields of a token response that carry a credential: the tokens issued (RFC 6749 section 5.1, OpenID Connect Core section 3.1.3.3). They are what a log masks of one, keeping the token type, the lifetime and scope granted, and an error response (RFC 6749 section 5.2) whole -- which is what says why an exchange failed.

func VerifierOption ¶

func VerifierOption(verifier string) auth_code_option.AuthCodeOption

VerifierOption returns a PKCE code verifier AuthCodeOption. It should be passed to Config.Exchange only.