What this test does
Sends a request without code_challenge. The spec allows servers to accept this for older clients, but current best practice is to require PKCE.
How it passes
Your server refuses the request.
- Specification
- §5.2, RFC 9700 §2.1.1
- Needs
- S106 Authorization endpoint is listed