Search code examples
spring-bootspring-securityoauth-2.0spring-security-oauth2spring-webclient

authorization code flow without code_challenge_method & code_challenge via spring-security-oauth2-client

We have identity server which does not support PKCE. It cannot be modified to include PKCE.

I am trying to implement authorization code flow on same identity server using spring-security-oauth2-client , spring-boot-starter-security & webclient. The generated authorization code uses code_challenge_method & code_challenge which is giving error while accessing token. Is there any way in spring to not use PKCE by default?

I am using spring boot version 2.3.4.RELEASE

Solution

  • Spring Security will use PKCE only, if the client doesn't have a client-secret configured.

    https://docs.spring.io/spring-security/site/docs/5.4.2/reference/html5/#oauth2Client-auth-code-grant