@ohmoreno at the moment there is not a clear road map for future enhancements. We'll add this as a future enhancement to consider.

OK, I'll be looking forward to it.

I'll give it a good read so maybe I can be of help.

Thanks.

Adding here for reference: https://tools.ietf.org/html/rfc7636

I also found a couple of examples:

https://www.example-code.com/phpext/okta_authorization_code_flow.asp (PHP)

https://auth0.com/docs/api-auth/tutorials/authorization-code-grant-pkce

And a well explained tutorial:
https://help.aweber.com/hc/en-us/articles/360036524474-How-do-I-use-Proof-Key-for-Code-Exchange-PKCE-

It would be really nice to have the PKCE support in order to be more secure

From 2022 PKCE ,state og nonce will be a requirement on some services. Its a recommendation from IETF.org

The Internet Engineering Task Force (IETF) is an open standards organization, which develops and promotes voluntary Internet standards, in particular the standards that comprise the Internet protocol suite (TCP/IP).[3] It has no formal membership roster or membership requirements. All participants and managers are volunteers, though their work is usually funded by their employers or sponsors.

https://no.wikipedia.org/wiki/Internet_Engineering_Task_Force

Hello,

We've developped an addon for the plugin to add support of PKCE https://github.com/BeAPI/openid-connect-generic-pkce-addon/.

Maybe it can help some people :)

Nicolas,

Sweet!
I'll check it out.
Thanks man.

@Rahe would you want to open up a PR to add this feature. We'd be very happy to include this as a built-in feature in the next release.

@timnolte We can work on a PR to add the feature.

Should PKCE be active by default or should it be controlled by a new option ?

In general all new features should be off by default, unless their on state is such that it wouldn't interfere with existing installations.

@timnolte any update on this? any way I can help?