pkce

Documentation

Overview

Package PKCE implements Proof Key for Code Exchange by OAuth Public Clients.

See also: https://datatracker.ietf.org/doc/html/rfc7636.

Index

• type Challenge
  • func ChallengeFromString(s string) (c Challenge)
  • func (c Challenge) AuthCodeOption() oauth2.AuthCodeOption
  • func (c Challenge) String() string
  • func (c Challenge) Verify(verifier Verifier, method Method) bool
• type Method
  • func MethodFromString(s string) (Method, error)
  • func (m Method) AuthCodeOption() oauth2.AuthCodeOption
  • func (i Method) String() string
• type Verifier
  • func New() (v Verifier, err error)
  • func VerifierFromString(s string) (v Verifier)
  • func (v Verifier) AuthCodeOption() oauth2.AuthCodeOption
  • func (v Verifier) Challenge(method Method) (c Challenge)
  • func (v Verifier) String() string

Types

type Challenge

type Challenge [43]byte

Challenge is a 43-octet URL safe PKCE Code Challenge.

Use `String()` to get a string representation of `Challenge` or `AuthCodeOption()` to get an option compatible with `golang.org/x/oauth2.Config.Exchange()`.

func ChallengeFromString

func ChallengeFromString(s string) (c Challenge)

ChallengeFromString returns a `Challenge` from its string representation.

func (Challenge) AuthCodeOption

func (c Challenge) AuthCodeOption() oauth2.AuthCodeOption

AuthCodeOption returns an option compatible with `golang.org/x/oauth2.Config.Exchange()`.

func (Challenge) String

func (c Challenge) String() string

String returns the string representation of the PKCE Code Challenge.

It implements `fmt.Stringer`.

func (Challenge) Verify

func (c Challenge) Verify(verifier Verifier, method Method) bool

Verify the PKCE Code Challenge using the given PKCE Code Verifier and method.

type Method

type Method uint8

Method used to create the PKCE Code Challenge.

const (
	MethodPlain Method = iota + 1 // plain
	MethodS256                    // S256
)

Available methods for creating the PKCE Code Challenge.

If the client is capable of using MethodS256, it MUST use MethodS256, as MethodS256 is Mandatory To Implement (MTI) on the server. Clients are permitted to use MethodPlain only if they cannot support MethodS256 for some technical reason and know via out-of-band configuration that the server supports MethodPlain.

The plain transformation is for compatibility with existing deployments and for constrained environments that can't use the S256 transformation.

See also: https://datatracker.ietf.org/doc/html/rfc7636#section-4.2.

func MethodFromString

func MethodFromString(s string) (Method, error)

MethodFromString returns a `Method` from its string representation.

func (Method) AuthCodeOption

func (m Method) AuthCodeOption() oauth2.AuthCodeOption

AuthCodeOption returns an option compatible with `golang.org/x/oauth2.Config.Exchange()`.

func (Method) String

func (i Method) String() string

type Verifier

type Verifier [43]byte

Verifier is a 43-octet URL safe PKCE Code Verifier.

Use `String()` to get a string representation of `Verifier` or `AuthCodeOption()` to get an option compatible with `golang.org/x/oauth2.Config.AuthCodeURL()`.

func New

func New() (v Verifier, err error)

New creates a new PKCE Code Verifier.

func VerifierFromString

func VerifierFromString(s string) (v Verifier)

VerifierFromString returns a `Verifier` from its string representation.

func (Verifier) AuthCodeOption

func (v Verifier) AuthCodeOption() oauth2.AuthCodeOption

AuthCodeOption returns an option compatible with `golang.org/x/oauth2.Config.AuthCodeURL()`.

func (Verifier) Challenge

func (v Verifier) Challenge(method Method) (c Challenge)

Challenge creates the PKCE Code Challenge for the PKCE Code Verifier using the given `Method`.

If the client is capable of using MethodS256, it MUST use MethodS256, as MethodS256 is Mandatory To Implement (MTI) on the server. Clients are permitted to use MethodPlain only if they cannot support MethodS256 for some technical reason and know via out-of-band configuration that the server supports MethodPlain.

The plain transformation is for compatibility with existing deployments and for constrained environments that can't use the S256 transformation.

See also: https://datatracker.ietf.org/doc/html/rfc7636#section-4.2.

func (Verifier) String

func (v Verifier) String() string

String returns the string representation of the PKCE Code Verifier.

It implements `fmt.Stringer`.