Implementing Authorization code flow with PKCE

Hello Devs,

I am implementing Google Sign in flow with PKCE. using this library and following Google’s documentation for authorization code flow with PKCE (https://developers.google.com/identity/protocols/OAuth2InstalledApp#step1-code-verifier) and my current code looks like.

client_id = --------.apps.googleusercontent.com'
client_secret = '--------'
redirect_uri = 'https://6c5b3b6c.ngrok.io/misc/hello/'
code_challenge = 'cr7
code_challenge_method = "S256"
scope = [
    #'https://www.googleapis.com/auth/userinfo.email',
    'email',
    'openid',
    'profile'
    #'https://www.googleapis.com/auth/userinfo.profile'
]
oauth = OAuth2Session(client_id, redirect_uri=redirect_uri,
                          scope=scope)

authorization_url, state = oauth.authorization_url(
        'https://accounts.google.com/o/oauth2/auth',
        # access_type and prompt are Google specific extra
        # parameters.
        access_type="offline", prompt="select_account")
print('Please go to %s and authorize access.' % authorization_url)
authorization_response = map(str, input('Enter the full callback URL: '))

token = oauth.fetch_token(
        'https://oauth2.googleapis.com/token',
        authorization_response=authorization_response,
        # Google specific extra parameter used for client
        # authentication
        client_secret=client_secret)
print(token)

But I have not found in documentation whether it supports authorization with PKCE. I am not sure where to pass my code_challenge and code_challenge_method variables in the request above.

[mattbaker-digital]

I’ve decided to take a stab at adding this functionality to the library. I’ll create a PR when it’s ready.

[mooreds]

thanks @mattbaker-digital !

We ended up working around this by just manually making the fetch token call. Anyone else interested can check out the PR here: https://github.com/FusionAuth/fusionauth-example-flask-portal/pull/1