Merge pull request #275 from JanssenProject/yuriyz_253

fix: pkce check has to be done after request object validation (FAPI OB)
JanssenProject · Oct 19, 2021 · ec859b6 · ec859b6
2 parents c08cda3 + 5af05cd
commit ec859b6
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/server/src/main/java/io/jans/as/server/par/ws/rs/ParRestWebService.java b/server/src/main/java/io/jans/as/server/par/ws/rs/ParRestWebService.java
@@ -133,7 +133,6 @@ public Response requestPushedAuthorizationRequest(
             redirectUriResponse.setFapiCompatible(appConfiguration.isFapi());
 
             parValidator.validateRequestUriIsAbsent(requestUri);
-            authorizeRestWebServiceValidator.validatePkce(codeChallenge, redirectUriResponse);
 
             final Integer parLifetime = client.getAttributes().getParLifetime();
 
@@ -167,6 +166,7 @@ public Response requestPushedAuthorizationRequest(
             par.getAttributes().setCustomParameters(requestParameterService.getCustomParameters(QueryStringDecoder.decode(httpRequest.getQueryString())));
 
             parValidator.validateRequestObject(redirectUriResponse, par, client);
+            authorizeRestWebServiceValidator.validatePkce(codeChallenge, redirectUriResponse);
 
             parService.persist(par);