fix(pkce): get code challenge and method from either body or query (redo #197)

jankapunkt · jankapunkt · commit ca43d4aa08c8 · 2023-11-01T08:46:39.000+01:00
diff --git a/lib/handlers/authorize-handler.js b/lib/handlers/authorize-handler.js
@@ -367,7 +367,7 @@ class  AuthorizeHandler {
   }
 
   getCodeChallenge (request) {
-    return request.body.code_challenge;
+    return request.body.code_challenge || request.query.code_challenge;
   }
 
   /**
@@ -378,7 +378,7 @@ class  AuthorizeHandler {
    *  (see https://www.rfc-editor.org/rfc/rfc7636#section-4.4)
    */
   getCodeChallengeMethod (request) {
-    const algorithm = request.body.code_challenge_method;
+    const algorithm = request.body.code_challenge_method || request.query.code_challenge_method;
 
     if (algorithm && !pkce.isValidMethod(algorithm)) {
       throw new InvalidRequestError(`Invalid request: transform algorithm '${algorithm}' not supported`);

Original file line number	Diff line number	Diff line change
`@@ -367,7 +367,7 @@ class AuthorizeHandler {`
`367`	`367`	`}`
`368`	`368`
`369`	`369`	`getCodeChallenge (request) {`
`370`		`- return request.body.code_challenge;`
	`370`	`+ return request.body.code_challenge \|\| request.query.code_challenge;`
`371`	`371`	`}`
`372`	`372`
`373`	`373`	`/**`
`@@ -378,7 +378,7 @@ class AuthorizeHandler {`
`378`	`378`	`* (see https://www.rfc-editor.org/rfc/rfc7636#section-4.4)`
`379`	`379`	`*/`
`380`	`380`	`getCodeChallengeMethod (request) {`
`381`		`- const algorithm = request.body.code_challenge_method;`
	`381`	`+ const algorithm = request.body.code_challenge_method \|\| request.query.code_challenge_method;`
`382`	`382`
`383`	`383`	`if (algorithm && !pkce.isValidMethod(algorithm)) {`
`384`	`384`	throw new InvalidRequestError(`Invalid request: transform algorithm '${algorithm}' not supported`);