[java-idp-oidc] branch main updated: JOIDC-63 Missing required PKCE code challenges should raise an error in the authorization endpoint

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=8f941932cb5d1d50f0d324f1e1e575e9a2792dce

The following commit(s) were added to refs/heads/main by this push:
     new 8f941932 JOIDC-63 Missing required PKCE code challenges should raise an error in the authorization endpoint
8f941932 is described below

commit 8f941932cb5d1d50f0d324f1e1e575e9a2792dce
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Mar 4 09:23:15 2022 +0200

    JOIDC-63 Missing required PKCE code challenges should raise an error in the authorization endpoint
    
    https://shibboleth.atlassian.net/browse/JOIDC-63
    
    Updated code comments to notice the presence of ValidateCodeChallenge action.
---
 .../net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCE.java    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCE.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCE.java
index b80e2e6e..3d367654 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCE.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCE.java
@@ -153,7 +153,7 @@ public class ValidatePKCE extends AbstractOIDCResponseAction {
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         if (codeChallenge == null || codeChallenge.isEmpty()) {
-            // To save one action we have this late verification of the authentication request for PKCE parameter.
+            // The authorize-flow already verifies this via ValidateCodeChallenge, but double-checking
             log.warn(
                     "{} No PKCE code challenge presented in authentication request" +
                             " even though required to access token endpoint", getLogPrefix());

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.