PKCE enforcement with OAuth2.0

[Q&A] General
1

Hi

I have been following: Novulo OAuth2.0 configuration and usage - Wiki - Novulo and it works perfectly. We’ve got a public client working.

While testing, I wanted to confirm whether PKCE is enforced for public clients, since the RFC recommends it as best practice when no client_secret is used. I tested the following:

  1. I sent a code_challenge and code_challenge_method=S256 in the /oauth2/authorize request.
  2. I completed login normally and received the authorization code.
  3. At /oauth2/token, I tried exchanging the code with:
  • the correct code_verifier. It succeeded, as expected
  • a random/mismatched code_verifier. It still succeeded
  • no code_verifier at all. It also still succeeded

So in all cases we received a valid access_token, regardless of whether the verifier matched. This probably means the code_challenge sent at the authorize step is currently accepted but not actually validated at the token step.

So my questions are:

  • Is PKCE validation supported for public clients, and are we possibly missing a configuration step or component revision to enable it?
  • If not currently supported, is PKCE enforcement on the roadmap for the OAuth2 Authorization Server component (M9939)?

Happy to share more details on our exact test setup if useful. Thanks!