pkce

Documentation

Overview

Package PKCE implements Proof Key for Code Exchange by OAuth Public Clients.

See also: https://datatracker.ietf.org/doc/html/rfc7636.

Index

• type Challenge
  • func ChallengeFromString(s string) (c Challenge)
  • func (c Challenge) AuthCodeOption() oauth2.AuthCodeOption
  • func (c Challenge) String() string
  • func (c Challenge) Verify(verifier Verifier, method Method) bool
• type Method
  • func MethodFromString(s string) (Method, error)
  • func (m Method) AuthCodeOption() oauth2.AuthCodeOption
  • func (i Method) String() string
• type Verifier
  • func New() (v Verifier, err error)
  • func VerifierFromString(s string) (v Verifier)
  • func (v Verifier) AuthCodeOption() oauth2.AuthCodeOption
  • func (v Verifier) Challenge(method Method) (c Challenge)
  • func (v Verifier) String() string

Types

type Challenge

type Challenge [43]byte

Challenge is a 43-octet URL safe PKCE Code Challenge.

Use Challenge.String to get a string representation of the challenge or Challenge.AuthCodeOption to get an option compatible with oauth2.Config.Exchange.

func ChallengeFromString

func ChallengeFromString(s string) (c Challenge)

ChallengeFromString returns a challenge from its string representation.

func (Challenge) AuthCodeOption

func (c Challenge) AuthCodeOption() oauth2.AuthCodeOption

AuthCodeOption returns an option compatible with oauth2.Config.Exchange.

func (Challenge) String

func (c Challenge) String() string

String returns the string representation of the PKCE Code Challenge.

It implements fmt.Stringer.

func (Challenge) Verify

func (c Challenge) Verify(verifier Verifier, method Method) bool

Verify the PKCE Code Challenge using the given PKCE Code Verifier and method.

type Method

type Method uint8

Method used to create the PKCE Code Challenge.

const (
	MethodPlain Method = iota + 1 // plain
	MethodS256                    // S256
)

Available methods for creating the PKCE Code Challenge.

If the client is capable of using MethodS256, it MUST use MethodS256, as MethodS256 is Mandatory To Implement (MTI) on the server. Clients are permitted to use MethodPlain only if they cannot support MethodS256 for some technical reason and know via out-of-band configuration that the server supports MethodPlain.

The MethodPlain transformation is for compatibility with existing deployments and for constrained environments that can't use the MethodS256 transformation.

See also: https://datatracker.ietf.org/doc/html/rfc7636#section-4.2.

func MethodFromString

func MethodFromString(s string) (Method, error)

MethodFromString returns a method from its string representation.

func (Method) AuthCodeOption

func (m Method) AuthCodeOption() oauth2.AuthCodeOption

AuthCodeOption returns an option compatible with oauth2.Config.Exchange.

func (Method) String

func (i Method) String() string

type Verifier

type Verifier [43]byte

Verifier is a 43-octet URL safe PKCE Code Verifier.

Use Verifier.String to get a string representation of the verifier or Verifier.AuthCodeOption to get an option compatible with oauth2.Config.AuthCodeURL.

func New

func New() (v Verifier, err error)

New creates a new PKCE Code Verifier.

func VerifierFromString

func VerifierFromString(s string) (v Verifier)

VerifierFromString returns a verifier from its string representation.

func (Verifier) AuthCodeOption

func (v Verifier) AuthCodeOption() oauth2.AuthCodeOption

AuthCodeOption returns an option compatible with oauth2.Config.AuthCodeURL.

func (Verifier) Challenge

func (v Verifier) Challenge(method Method) (c Challenge)

Challenge creates the PKCE Code Challenge for the PKCE Code Verifier using the given method.

If the client is capable of using MethodS256, it MUST use MethodS256, as MethodS256 is Mandatory To Implement (MTI) on the server. Clients are permitted to use MethodPlain only if they cannot support MethodS256 for some technical reason and know via out-of-band configuration that the server supports MethodPlain.

The MethodPlain transformation is for compatibility with existing deployments and for constrained environments that can't use the MethodS256 transformation.

See also: https://datatracker.ietf.org/doc/html/rfc7636#section-4.2.

func (Verifier) String

func (v Verifier) String() string

String returns the string representation of the PKCE Code Verifier.

It implements fmt.Stringer.