Enable PKCE for OIDC flows

Source: outline/outline#7706 · opened by @micolous

Outline's OIDC authentication provider currently *always* disables [PKCE]( support:

This appears to be from [the original PR for generic OAuth2 support](

At present, Outline cannot authenticate to a server which requires PKCE support.

Background

Per [RFC 7636 section 5](

> Server implementations of this specification MAY accept OAuth2.0
> clients that do not implement this extension. If the "code_verifier"
> is not received from the client in the Authorization Request, servers
> supporting backwards compatibility revert to the OAuth 2.0 [[RFC6749](
> protocol without this extension.

"MAY" indicates that the fallback mechanism is truly optional; so an authorisation provider could *require* *all* clients support PKCE for security reasons (regardless of whether the security weakness outlined in RFC 7636 applies to them).

Edit: more background reading:

2 years ago