fix: generatePKCEChallenge should use btoa (#1044)

hf · web-flow · commit 15d308e293ed · 2025-03-24T22:52:18.000+01:00
`stringToBase64URL` expects a unicode string [not a data string](https://developer.mozilla.org/en-US/docs/Web/API/Window/btoa).
diff --git a/packages/core/auth-js/src/lib/helpers.ts b/packages/core/auth-js/src/lib/helpers.ts
@@ -289,7 +289,7 @@ export async function generatePKCEChallenge(verifier: string) {
     return verifier
   }
   const hashed = await sha256(verifier)
-  return stringToBase64URL(hashed)
+  return btoa(hashed).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
 }
 
 export async function getCodeChallengeAndMethod(

Original file line number	Diff line number	Diff line change
`@@ -289,7 +289,7 @@ export async function generatePKCEChallenge(verifier: string) {`
`289`	`289`	`return verifier`
`290`	`290`	`}`
`291`	`291`	`const hashed = await sha256(verifier)`
`292`		`- return stringToBase64URL(hashed)`
	`292`	`+ return btoa(hashed).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')`
`293`	`293`	`}`
`294`	`294`
`295`	`295`	`export async function getCodeChallengeAndMethod(`