Optional PKCE

[liviozanol]

As stated on the migration document (https://github.com/authts/oidc-client-ts/blob/main/docs/migration.md) PKCE should be optional even when using code type.

How to config oidc-client-ts to not send code_challenge, code_challenge_method, etc. to the identity server?

Tried to set code_verifier to false but it didn't make any difference.

Thanks in advance.

See also: IdentityModel/oidc-client-js#1360

[pamapa]

The Authorization Code Grant code path is using PKCE, there is no alternative code path in the library, which can be enabled.

This library focuses on OAuth 2.1, which says:

• PKCE is required for all OAuth clients using the authorization code flow

That said, we might should improve the migration docu, which seems outdated...

[liviozanol]

Ok. got it. So maybe it is a good idea to change the migration.md description?

It clearly says "PKCE remains optional"

[pamapa]

would be great if you make a merge request and fix that in the documentation!

[Moshyfawn]

Is #789 enough to explain the code flow change as per #783 (comment)?