OAuth2Manager.RequestAuthWithParamsAsync ignoring request for no code challenge

Open

#5,657 opened on Jul 27, 2025 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

area-Security needs-triage

Dominant language: C++
Stars: 4.7k
Forks: 471
Avg merge: 3d 13h
Merged PRs (30d): 28

Description

### Describe the bug

OAuth2Manager.RequestAuthWithParamsAsync ignores parameters

So the OAuth2Manager always sends the code challenge

### Steps to reproduce the bug

In OAuth2Manager.cpp this check is somehow ignored
`if ((m_params->CodeChallengeMethod() != CodeChallengeMethodKind::None) && m_params->CodeChallenge().empty())
{
m_params->set_code_challenge(winrt::hstring{ random_base64urlencoded_string(32) });
}`

### Expected behavior

Code challenge is not send to identity server

### Screenshots

### NuGet package version

Windows App SDK 1.8 Experimental 4: 1.8.250702007-experimental4

### Packaging type

Unpackaged

### Windows version

Windows 11 version 24H2 LTSC (26100, June Update)

### IDE

Visual Studio 2022

### Additional context

_No response_

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Research direction

Start in OAuth2Manager.cpp at RequestAuthWithParamsAsync and inspect how CodeChallengeMethodKind::None is handled around the shown code-challenge check. Trace the request parameters through to the identity-server request; the fix is complete when a request configured without a code challenge sends no code-challenge parameter.

Written by the indexing model from the issue text.

Assessment

Tech stack: cpp
Domain: authentication, desktop
Issue type: Bug
Difficulty: 3/5
Estimated time: 1-2 days
Activity status: Stale
Clarity: Clearly specified
Newbie friendliness: 48/100