Docs - code_verifier in authorization_code

[matiseni51]

Hi!

I'm testing from scratch and i was following the documentation to implement Authorization Code grant type but at the moment that i made the request to get the access_token, i get {error: invalid_grant}. (I even extend the grant expire time)

I test different combination between this attributes and i succeeded using CODE_CHALLENGE instead of CODE_VERIFIER
(django-oauth-toolkit/docs/getting_started.rst - line 308 & 319) -
just the value though, like code_verifier=${CODE_CHALLENGE}

Looking at those values, I think make sense:

If i'm right, maybe the bigger fix would be changing that flag -d code_challenger=${CODE_CHALLENGE}

[tykling]

Thank you for this! It got me on the right path to finding the root cause. Your PR is correct in the sense that to make plain work you compare the challenge and the verifier directly.

However the rest of the example in the docs is clearly based on/indended using the S256 method. When you add code_challenge_method=S256 to the authorize call, and then use code_verifier in the token call, it works as intended.

So I think what needs to be done is to add code_challenge_method=S256 to the token curl call in the docs. Works for me at least :)

[matiseni51]

Glad to help!
I tried different things base on your comment and i replicated the behavior that you mention, therefore I updated the PR with that flag.

Also, just point out a case that seems curious to me: even though i selected a SHA-2 256 Algorithm when i registered a new app, if i don't add the code_challenge_method flag in the authorization call, the issue that i describe before still works when i make the token call (Basically, the Grant object is set in code_challenge_method=S256 and i can get the token calling with code_verifier=${CODE_CHALLENGE} ).

[tykling]

That is because the dropdown at the bottom of the application create form has to do with OIDC, and what we are talking about here is PKCE. SHA256 is used in both but the dropdown is not related to PKCE.

[tykling]

Your PR looks correct to me now 👍