enable PKCE for confidential dynamic clients - #1682
Conversation
MCP / OAuth 2.1 clients send a code_challenge even when they register confidential, and /authorize then rejects them with "'code_challenge' not enabled for this client". enable it for every dynamic client, not only public ones.
sebadob
left a comment
sebadob
left a comment
There was a problem hiding this comment.
This is not going to happen in this way, as it would break lots of clients. Rauthy is very strict. If PKCE is enabled, it enforces it. This means a confidential client MUST always provide a PKCE challenge if configured, it is not optional.
The only proper solution for this would be a new config variable that allows optional PKCE values for confidential DCR clients only. You cannot implement a fix that only works for one specific client. It must work for all of them. Usually, clients will not send a PKCE challenge when they are confidential. It will very slightly boost the security, but it's also kind of redundant. PKCE was created to make public client logins more safe. In terms of security, you don't really need it.
2 participants
DCR clients register confidential by default, but MCP / OAuth 2.1 clients still send a
code_challenge, so/authorizerejects them with'code_challenge' not enabled for this client. Enable PKCE for every dynamic client, not only public ones.