Enable toggle for PKCE in Pushed Authorization Requests

[alvinangjh]

Hey there! First and foremost, thank you so much for all the hard work and time you've poured into this project — truly appreciate it 🫡 !

I was wondering if there's been any consideration around supporting a toggle to enable PKCE for the Pushed Authorization Request (PAR) flow?

I understand that the PAR specification notes:

NOTE: PAR does not present any additional security concerns that necessitated the requirement to use PKCE - the reason PKCE is not required in other cases is merely to be backwards compatible with earlier drafts of this standard.

However, the OIDC Specification also states:

shall require PAR requests, if supported, to use PKCE (RFC7636) with S256 as the code challenge method.

Given this, I’d love to know if supporting a PKCE toggle for PAR is something that's on the roadmap or a feature option worth exploring?

[panva]

Hi @alvinangjh PKCE is already supported in all applicable flows.

[alvinangjh]

Hi! I just realized that the PKCE requirement is coming from the pkce.required function — which is great, since it gives flexibility to implement custom logic.

Initially, I was thinking it might be nice to have a built-in toggle in the pushedAuthorizationRequests config, something like:

pushedAuthorizationRequests: {
  enabled: true,
  pkceRequired: true,
}

That way, PKCE could be enforced specifically for PAR flows, while leaving standard Authorization Code flows untouched.

In any case, thanks so much for this library — really appreciate the work that’s gone into it. Cheers!