Exosphere.ATProto.OAuth.PKCE (Exosphere v0.5.0)

Copy Markdown View Source

PKCE (RFC 7636) code verifiers and challenges.

ATProto OAuth requires the S256 challenge method: the verifier never travels over the wire, and the authorization server only ever sees BASE64URL(SHA256(verifier)).

Summary

Functions

challenge(verifier)

Compute the S256 code challenge for a verifier.

generate_verifier()

Generate a random code verifier.

valid_verifier?(verifier)

Check that a verifier is syntactically valid per RFC 7636: 43–128 characters from the unreserved set ALPHA / DIGIT / "-" / "." / "_" / "~".

Functions

challenge(verifier)

@spec challenge(String.t()) :: String.t()

Compute the S256 code challenge for a verifier.

generate_verifier()

@spec generate_verifier() :: String.t()

Generate a random code verifier.

Returns 43 unreserved characters (BASE64URL of 32 random bytes, no padding), the minimum length allowed by RFC 7636.

valid_verifier?(verifier)

@spec valid_verifier?(term()) :: boolean()

Check that a verifier is syntactically valid per RFC 7636: 43–128 characters from the unreserved set ALPHA / DIGIT / "-" / "." / "_" / "~".