Constructor PkceCodeChallenge

Namespace

MailFathom.Common.OAuth

Assembly

MailFathom.Common.dll

PkceCodeChallenge(string, string)

One RFC 7636 proof-key pair binding an authorization request to the token request that redeems it.

public PkceCodeChallenge(string Verifier, string Challenge)

Parameters

Verifier string

The high-entropy secret sent only with the token request.

Challenge string

The SHA-256 digest of the verifier, sent with the authorization request.

Remarks

PKCE is not optional here even though a confidential client could authenticate with its secret alone. The authorization code travels back through a loopback address, and on a shared machine any local process can race to bind that port or read the code out of a browser history; the verifier is what makes an intercepted code useless without it. Google requires PKCE for installed applications, and Microsoft requires it for public clients.