From c1d861070692aff5fdafc52ef6b427fde346dfcc Mon Sep 17 00:00:00 2001 From: Matheus Lemos <37716097+mthlemos@users.noreply.github.com> Date: Tue, 31 Oct 2023 15:23:10 -0300 Subject: [PATCH] Get code_challenge and _method from query if not present in body Reintroduce PR #197 fix --- lib/handlers/authorize-handler.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/handlers/authorize-handler.js b/lib/handlers/authorize-handler.js index a02a5b9..12ca72c 100644 --- a/lib/handlers/authorize-handler.js +++ b/lib/handlers/authorize-handler.js @@ -367,7 +367,7 @@ class AuthorizeHandler { } getCodeChallenge (request) { - return request.body.code_challenge; + return request.body.code_challenge || request.query.code_challenge; } /** @@ -378,7 +378,7 @@ class AuthorizeHandler { * (see https://www.rfc-editor.org/rfc/rfc7636#section-4.4) */ getCodeChallengeMethod (request) { - const algorithm = request.body.code_challenge_method; + const algorithm = request.body.code_challenge_method || request.query.code_challenge_method; if (algorithm && !pkce.isValidMethod(algorithm)) { throw new InvalidRequestError(`Invalid request: transform algorithm '${algorithm}' not supported`);