OIDC PKCE should be allowed with hybrid flow
Open
area-auth
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
This line only allows the use of PKCE with code flow:
https://github.com/dotnet/aspnetcore/blob/master/src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs#L369
But PKCE can also be used with hybrid flow. Please allow that as well.
Contributor guide
Assessment
This issue has not been assessed yet.