Kong / Kong/insomnia

code_challenge_method not sent when value is set to SHA-256

Open
#5,765 14 comments 3 reactions 0 assignees View on GitHub
A-oauth B-bug S-unverified
Dominant language
TypeScript
Stars
40k
Forks
2.4k
Avg merge
2d 13h
Merged PRs (30d)
61

Description

### Expected Behavior

query parameters on generated url to contain `code_challenge_method=S256`

### Actual Behavior

query parameters do not contain `code_challenge_method`

### Reproduction Steps

1. create new http request in Insomnia (I'm using 2022.7.5)
2. click Auth tab and select OAuth 2; complete form, any clientId will do, specifying grant type of Authorization Code, check Use PKCE & ensure Code Challenge Method is `SHA-256`; Authorization and Access Token URLs can be some local endpoint you have spun up, or any endpoint where query parameters can be examined
3. click Fetch Tokens button
4. examine provided query parameters - `code_challenge_method` is missing

### Is there an existing issue for this?

- [X] I have searched the [issue tracker](https://www.github.com/Kong/insomnia/issues) for this problem.

### Additional Information

specifying a Code Challenge Method of Plain results in `code_challenge_method=plain` being sent, as expected

I've gone back and checked the last few versions, looks like this regressed in 2022.7.2 (perhaps coincides with the addition of the redirect uri validation)

### Insomnia Version

2022.7.5

### What operating system are you using?

Windows

### Operating System Version

Windows 10 21H2

### Installation method

insomnia.rest install

### Last Known Working Insomnia version

2022.7.1

Contributor guide

Open the contributing guide

Research direction

Start at the Auth tab's OAuth 2 flow and the Fetch Tokens action, then trace how PKCE parameters are added to the authorization URL. Compare the SHA-256 and Plain code challenge method paths, using the reported regression between versions 2022.7.1 and 2022.7.2 as a guide. Done means SHA-256 requests include code_challenge_method=S256 while Plain continues to send code_challenge_method=plain.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.