Module pkce 

RFC 7636 PKCE (Proof Key for Code Exchange), as narrowed by OAuth 2.1.

Why plain is refused by default

RFC 7636 §4.2 defines two challenge methods, plain and S256. OAuth 2.1 (draft-ietf-oauth-v2-1-16 §7.5.2) then forbids plain outright, on the grounds that its only historical justification was clients incapable of SHA-256 — and that OAuth 2.1 requires TLS 1.2+, which mandates SHA-256, so “any device capable of implementing OAuth 2.1 necessarily supports SHA-256.”

PkcePolicy::default therefore refuses plain. A deployment that really does face a client without SHA-256 can say so with PkcePolicy::allow_plain, which exists as an explicit, greppable decision rather than as an accident of a &str comparison.

Why the method is a type, not a string

This module used to take method: &str and return bool. A client that sent "s256", "S-256" or "S256 " got a quiet false — indistinguishable from a wrong verifier. Those are different failures: a typo is a client bug to be reported, a mismatch is a possible attack to be refused silently. PkceMethod parses once and fails loudly; verify returns a [PkceOutcome] that says which it was.

Structs

PkcePolicy

Which challenge methods this server accepts.

Enums

PkceError

Why a PKCE verification failed.

PkceMethod

PKCE code challenge method.

Constants

MAX_VERIFIER_LEN

Maximum length of a code_verifier, from RFC 7636 §4.1.

MIN_VERIFIER_LEN

Minimum length of a code_verifier, from RFC 7636 §4.1.

Functions

generate_pkce_pair

Generate a PKCE code verifier and its S256 challenge.

validate_verifier

Validate a code_verifier against RFC 7636 §4.1’s syntax.

verify

Verify a PKCE code challenge against the verifier, under policy.

verify_with_default_policy

Verify using the default policy (S256 only).