Are plain code challenge methods supported?

[mschwager]

When I hit the openid-configuration endpoint I see the following:

"code_challenge_methods_supported": [
    "plain",
    "S256"
]

And I see the following in the code:

hydra/oauth2/handler.go

Line 509 in 0421fda

CodeChallengeMethodsSupported: []string{"plain", "S256"},

However, I also see this in the code:

hydra/fositex/config.go

Lines 133 to 135 in 0421fda

	func (c *Config) GetEnablePKCEPlainChallengeMethod(context.Context) bool {
	return false
	}

I believe this corresponds to the following fosite code:

https://github.com/ory/fosite/blob/1f27af44d4f83c258c118839ca3171fff08aa77b/handler/pkce/handler.go#L91-L98

So I'm wondering, does hydra support plain code challenges? Is this a bug that the configuration endpoint returns plain?

[jan-berge-ommedal]

Stumbled upon this today and it does indeed look like an inconsistency between the configuration information and what hydra actually supports. Looks doable to make a PR to resolve this inconsistency if the maintainers can advice on whether support for plain code challenges should be added (optionally configurable through client or server config) OR if the configuration response should be fixed.