+1 -1

atproto/auth/oauth/oauth.go

reviewed

··· 311 311 pkceVerifier := fmt.Sprintf("%s%s%s", randomNonce(), randomNonce(), randomNonce()) 312 312 313 313 // generate PKCE code challenge for use in PAR request 314 314 - codeChallenge := s256CodeChallenge(pkceVerifier) 314 314 + codeChallenge := S256CodeChallenge(pkceVerifier) 315 315 316 316 slog.Debug("preparing PAR", "client_id", app.Config.ClientID, "callback_url", app.Config.CallbackURL) 317 317 body := PushedAuthRequest{

+1 -1

atproto/auth/oauth/session.go

reviewed

··· 171 171 sess.lk.RLock() 172 172 defer sess.lk.RUnlock() 173 173 174 174 - ath := s256CodeChallenge(sess.Data.AccessToken) 174 174 + ath := S256CodeChallenge(sess.Data.AccessToken) 175 175 claims := dpopClaims{ 176 176 HTTPMethod: method, 177 177 TargetURI: reqURL,

+2 -1

atproto/auth/oauth/util.go

reviewed

··· 13 13 return base64.RawURLEncoding.EncodeToString(buf) 14 14 } 15 15 16 16 - func s256CodeChallenge(raw string) string { 16 16 + // Computes an SHA-256 base64url-encoded challenge string, as used for PKCE. 17 17 + func S256CodeChallenge(raw string) string { 17 18 b := sha256.Sum256([]byte(raw)) 18 19 return base64.RawURLEncoding.EncodeToString(b[:]) 19 20 }