PKCE and applications that exchange authz code server-side

[whitehatguy]

fhir-client now appears to default to attempt to add the PKCE extension if a FHIR server advertises it. However, if an a fhir-client consumer has written their own logic to exchange the authorization code for a token (perhaps in the case of a server-side confidential client app), PKCE would appear to break those applications when they uplift to 2.5.

Is this a concern? I have seen at least one application break now when we started advertising support for PKCE code_challenges.

[kolkheang]

I was helping someone with this exact issue. It's still happening today.

I found this API documentation. In this doc, there is an option for pkceMode which defaults to "ifSupported" by default. There is an option to set pkceMode to "disabled" to disable this default behavior.

I think this is why we see the issue since the .well-known/smart-configuration endpoint has code_challenge_methods_supported with S256 as an option, and the code only checks if s256 is supported on the server.