Package `rfc7636`

import "funnyhaha.technology/rfc/rfc7636"

View the source code

Overview

Package rfc7636 implements the parts of RFC 7636 (Proof Key for Code Exchange, PKCE) that an authorization server needs: checking the code challenge in an authorization request, and verifying the code verifier in the token request against it.

challenge, err := rfc7636.ParseChallenge(q.Get("code_challenge_method"), q.Get("code_challenge"))
// ... later, at the token endpoint:
verifier, err := rfc7636.ParseVerifier(form.Get("code_verifier"))
ok := rfc7636.Verify(verifier, challenge)

Only the S256 method is supported. OAuth 2.1 requires S256, and the "plain" method sends the verifier itself as the challenge.

The RFC text is in rfc7636.txt in this directory, and the doc comments cite its sections.

Constants

const MethodS256 = "S256"

source

MethodS256 is the only code challenge method this package supports. Section 4.2 defines it, and Section 7.2 says "plain" is only for clients that can't do S256. OAuth 2.1 drops "plain" for that reason.

Variables

var (
	// ErrInvalidVerifier is returned by [ParseVerifier] for a code
	// verifier that isn't 43 to 128 unreserved characters.
	ErrInvalidVerifier = errors.New("invalid code verifier")

	// ErrInvalidChallenge is returned by [ParseChallenge] for a code
	// challenge that isn't an S256 hash.
	ErrInvalidChallenge = errors.New("invalid code challenge")

	// ErrUnsupportedMethod is returned by [ParseChallenge] for a method
	// other than S256, including an empty one, which Section 4.3 says
	// means "plain".
	ErrUnsupportedMethod = errors.New("unsupported code challenge method")
)

source

Functions

`Verify` source

func Verify(v Verifier, c Challenge) bool

Verify reports whether v hashes to c, comparing in constant time (Section 4.6).

Types

`Challenge` source

type Challenge string

Challenge is an S256 code challenge: the hash a client sends to the authorization endpoint. Use ParseChallenge to check a string, or Verifier.Challenge to compute one.

See RFC 7636, Section 4.2.

`ParseChallenge` source

func ParseChallenge(method, challenge string) (Challenge, error)

ParseChallenge returns the code challenge sent with the method, or ErrUnsupportedMethod if the method isn't S256, and ErrInvalidChallenge if the challenge isn't 43 base64url characters, the length of a SHA-256 hash (Section 4.2).

`Verifier` source

type Verifier struct {
	// contains filtered or unexported fields
}

Verifier is a code verifier: the secret a client sends to the token endpoint. Use ParseVerifier to check a string. Its String method doesn't reveal it.

See RFC 7636, Section 4.1.

`ParseVerifier` source

func ParseVerifier(s string) (Verifier, error)

ParseVerifier returns s as a Verifier, or ErrInvalidVerifier if it isn't 43 to 128 characters from [A-Z] / [a-z] / [0-9] / "-" / "." / "_" / "~" (Section 4.1).