Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Allow configuring PKCE for confidential clients

Browse Source 
Closes gh-6548
This commit is contained in:
Joe Grandja
2022-03-15 10:25:17 -04:00
parent 7955e5ac52
commit a2ffc88294
8 changed files with 369 additions and 147 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
docs/modules/ROOT/pages/reactive/oauth2/client/authorization-grants.adoc
View File

@@ -72,6 +72,9 @@ If the client is running in an untrusted environment (eg. native application or
. `client-secret` is omitted (or empty)
. `client-authentication-method` is set to "none" (`ClientAuthenticationMethod.NONE`)
[TIP]
If the OAuth 2.0 Provider supports PKCE for https://tools.ietf.org/html/rfc6749#section-2.1[Confidential Clients], you may (optionally) configure it using `DefaultServerOAuth2AuthorizationRequestResolver.setAuthorizationRequestCustomizer(OAuth2AuthorizationRequestCustomizers.withPkce())`.
[[oauth2Client-auth-code-redirect-uri]]
The `DefaultServerOAuth2AuthorizationRequestResolver` also supports `URI` template variables for the `redirect-uri` using `UriComponentsBuilder`.