Merge pull request #2209 from damienbod/fix/disable-pkce-par-flow

Fix: don't send code_challenge in PAR flow when disablePkce is true

Author: damienbod

projects/angular-auth-oidc-client/src/lib/utils/url/url.service.spec.ts

@@ -1397,6 +1397,43 @@ describe('UrlService Tests', () => {
         );
       });
     }));
+
+    it('omits code_challenge and code_challenge_method when disablePkce is true', waitForAsync(() => {
+      const config = {
+        clientId: 'testClientId',
+        responseType: 'testResponseType',
+        scope: 'testScope',
+        hdParam: undefined,
+        customParamsAuthRequest: undefined,
+        redirectUrl: 'testRedirectUrl',
+        disablePkce: true,
+      };
+
+      spyOn(
+        flowsDataService,
+        'getExistingOrCreateAuthStateControl'
+      ).and.returnValue('testState');
+      spyOn(flowsDataService, 'createNonce').and.returnValue('testNonce');
+      const createCodeVerifierSpy = spyOn(
+        flowsDataService,
+        'createCodeVerifier'
+      ).and.returnValue('testCodeVerifier');
+      const generateCodeChallengeSpy = spyOn(
+        jwtWindowCryptoService,
+        'generateCodeChallenge'
+      ).and.returnValue(of('testCodeChallenge'));
+      const resultObs$ = service.createBodyForParCodeFlowRequest(config);
+
+      resultObs$.subscribe((result) => {
+        expect(result).toBe(
+          `client_id=testClientId&redirect_uri=testRedirectUrl&response_type=testResponseType&scope=testScope&nonce=testNonce&state=testState`
+        );
+        expect(result).not.toContain('code_challenge');
+        expect(result).not.toContain('code_challenge_method');
+        expect(createCodeVerifierSpy).not.toHaveBeenCalled();
+        expect(generateCodeChallengeSpy).not.toHaveBeenCalled();
+      });
+    }));
   });
 
   describe('createUrlImplicitFlowWithSilentRenew', () => {

projects/angular-auth-oidc-client/src/lib/utils/url/url.service.ts

@@ -392,11 +392,7 @@ export class UrlService {
       'Authorize created. adding myautostate: ' + state
     );
 
-    // code_challenge with "S256"
-    const codeVerifier =
-      this.flowsDataService.createCodeVerifier(configuration);
-
-    return this.jwtWindowCryptoService.generateCodeChallenge(codeVerifier).pipe(
+    return this.getCodeChallenge(configuration).pipe(
       map((codeChallenge: string) => {
         const {
           clientId,
@@ -413,8 +409,11 @@ export class UrlService {
         params = params.append('scope', scope ?? '');
         params = params.append('nonce', nonce);
         params = params.append('state', state);
-        params = params.append('code_challenge', codeChallenge);
-        params = params.append('code_challenge_method', 'S256');
+
+        if (!configuration.disablePkce) {
+          params = params.append('code_challenge', codeChallenge);
+          params = params.append('code_challenge_method', 'S256');
+        }
 
         if (hdParam) {
           params = params.append('hd', hdParam);