Hi Timothy,
I created a simple OAuth 2.0 test app that runs the Authorization Code flow with PKCE. It's written using NodeJS Express. It uses direct REST calls (with axios) since, as pointed out, the SDK doesn't support PKCE.
To use this, unpack the zip file, copy dotenv.sample to .env and complete for your tenant. Run "npm install" and then "npm start".
The web server listens on localhost:3000.
This is just my test code - I'm sure it's not particularly secure or suitable for any production use - but perhaps someone will find it instructive.
Cheers... Jon.
------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------
Original Message:
Sent: Thu March 17, 2022 10:22 AM
From: Timothy Dilbert
Subject: Does the ibm-verify-sdk support PKCE?
Thanks, Carsten.
I was able to implement it by manually developing the redirects in my SPA. Since the SPA I'm currently building is based on the IBM Carbon Design System, I will at some point do a blog post on our website, and post a link to it here for others to see.
------------------------------
Timothy
------------------------------
Original Message:
Sent: Thu March 17, 2022 09:24 AM
From: Carsten Hagemann
Subject: Does the ibm-verify-sdk support PKCE?
Hi Timothy,
The JavaScript SDK does not support PKCE. If you would like to see this added, please submit it here.
------------------------------
Carsten Hagemann