Server tests · Authorization requests
S222 Refuses a challenge without a method
Recommended Browser check
What this test does
Sends code_challenge with no code_challenge_method. RFC 7636 says a missing method means plain, which is not allowed here.
How it passes
Your server refuses the request, unless it advertises plain support.
- Specification
- RFC 7636 §4.3, RFC 9700 §2.1.1
- Needs
- S109 PKCE S256 is supported