Server tests · Authorization requests
S221 Refuses a PKCE method without a challenge
Recommended Browser check
What this test does
Sends code_challenge_method=S256 with no code_challenge. A server that still allows older clients to sign in without PKCE can mistake this for one of them, and a challenge stripped from a real client's request leaves a code anyone can redeem.
How it passes
Your server refuses the request.
- Specification
- §5.2, RFC 7636 §4.3
- Needs
- S106 Authorization endpoint is listed