pkce

Documentation

Index

• Constants
• Variables
• func GenerateCodeChallenge(transformation, codeVerifier string) (string, error)
• func GenerateCodeVerifier(length int) (string, error)
• func VerifyCodeVerifier(transformation, codeVerifier, codeChallenge string) error

Constants

const (
	// CodeVerifierMinimumLength in bytes
	CodeVerifierMinimumLength = 43
	// CodeVerifierMaximumLength in bytes
	CodeVerifierMaximumLength = 128
	// S256Transformation uses SHA256 as the hashing method
	S256Transformation = "S256"

	//    The plain transformation is for compatibility with existing
	//    deployments and for constrained environments that can't use the S256
	//    transformation.
	PlainTransformation = "plain"
)

Variables

var InvalidGrantError = errors.New("invalid_grant")

InvalidGrantError is returned when the provided authorization grant (e.g., authorization, code, resource owner credentials) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client. Ref. RFC6749 Section 5.2

Functions

func GenerateCodeChallenge

func GenerateCodeChallenge(transformation,
	codeVerifier string) (string, error)

GenerateCodeChallenge generates a code challenge from a code verifier using the specified transformation.

func GenerateCodeVerifier

func GenerateCodeVerifier(length int) (string, error)

GenerateCodeVerifier generates a high-entropy cryptographic random STRING using the unreserved characters

[A-Z] / [a-z] / [0-9] / "-" / "." / "_" / "~"

from Section 2.3 of [RFC3986], with a minimum length of 43 characters and a maximum length of 128 characters.

func VerifyCodeVerifier

func VerifyCodeVerifier(
	transformation, codeVerifier, codeChallenge string) error

VerifyCodeVerifier returns an error if the codeVerifier does not equal the codeChallenge when transformed using the specified method. This function only returns error if the verification fails. If the values are not equal or the verifier is not valid, an error response indicating "invalid_grant" as described in Section 5.2 of [RFC6749] is returned.