Class PkceCodeChallenge

Namespace

MailFathom.Common.OAuth

Assembly

MailFathom.Common.dll

One RFC 7636 proof-key pair binding an authorization request to the token request that redeems it.

public sealed record PkceCodeChallenge : IEquatable<PkceCodeChallenge>

Inheritance

object

PkceCodeChallenge

Implements

IEquatable<PkceCodeChallenge>

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

Remarks

PKCE is not optional here even though a confidential client could authenticate with its secret alone. The authorization code travels back through a loopback address, and on a shared machine any local process can race to bind that port or read the code out of a browser history; the verifier is what makes an intercepted code useless without it. Google requires PKCE for installed applications, and Microsoft requires it for public clients.

Constructors

PkceCodeChallenge(string, string)

One RFC 7636 proof-key pair binding an authorization request to the token request that redeems it.

Properties

Challenge

The SHA-256 digest of the verifier, sent with the authorization request.

Verifier

The high-entropy secret sent only with the token request.

Methods

Create()

Creates a pair from cryptographically secure random material.

ToString()

Returns a string that represents the current object.