Third-party login: Invalid code verifier in PKCE flow

Description:

This is a follow-up to #35419 which was only partly fixed in #37707. When using the implicit code flow, the fix introduced in 8.0.0 works. However, the PKCE flow remains dysfunctional even with the fix. It cannot exchange the authorization code for tokens at the token endpoint. The error code is invalid_grant with the message Invalid grant: code verifier is invalid .

Steps to reproduce:

1. Create a third-party login application in the Rocket Chat admin panel (https://example.com/admin/third-party-login).
2. Enter Redirect URI: https://oauthdebugger.com/debug.
3. Activate and note down Client ID, Authorization URL and Access Token URL.
4. Head over to https://oauthdebugger.com/debug
5. Enter Authorize URI, Client ID, Scope (openid),
6. Select Response type: [x] code, [x] Use PKCE?, [x] SHA-256.
7. Enter Token URI
8. Select Response mode: [x] query
9. Send request
10. Authorize at Rocket Chat
11. Response page shows the failure, see screenshot below.

Expected behavior:

Should be able to exchange authorization code for tokens at the token endpoint when using a PKCE code challenge. PKCE is crucial for securing OAuth 2.0, especially in modern implementations. It prevents authorization code interception attacks that target public clients like mobile apps and SPAs.

Actual behavior:

Server Setup Information:

• Version of Rocket.Chat Server: 8.1.1
• License Type:
• Number of Users:
• Operating System: Ubuntu 24.04.
• Deployment Method: docker
• Number of Running Instances:
• DB Replicaset Oplog:
• NodeJS Version:
• MongoDB Version:

Start by reproducing the PKCE flow from the Rocket.Chat admin panel using oauthdebugger.com, following the listed authorization and token requests. Trace the third-party login authorization-code exchange and compare it with the implicit flow fixed in #37707; done means the PKCE authorization code exchanges successfully for tokens without the invalid_grant error.