Support PKCE for Authorization Server

[eddumelendez]

In order to track the support to PKCE support as per comment in spring-attic/spring-security-oauth#675 (comment)

https://tools.ietf.org/html/rfc7636

[justin-gardiner]

Hi, is there any early version of this we could have a look at?

[jgrandja]

@justin-gardiner This issue is tagged as a new feature, so no there is no earlier version.

[Sytten]

This is quite an important feature for mobile authentification, not sure how people are living without it...

[jgrandja]

We will prioritize this feature when we start the Authorization Server support later this year.

[kmualem]

Hi guys,

Is there an estimation when there will be a support of PKCE?

Thanks,
Kobi.

[rwinch]

@kmualem I'm sorry there is not yet any additional details on this feature. When there are additional details, we will update this issue

[kmualem]

Thanks @rwinch for the update

[johnhunsley]

@kmualem I'm sorry there is not yet any additional details on this feature. When there are additional details, we will update this issue

@rwinch Do you know which release of v5 PKCE is planned for? I'd like to get involved if possible?

Thanks.

[tlodderstedt]

FYI - PKCE is becoming more import as the OAuth working group recommends use of PKCE for ALL kinds of apps to detect code injection (https://tools.ietf.org/html/draft-ietf-oauth-security-topics-10#section-2.1.1).