generateCodeVerifier creates a cryptographically secure random string to be used as the code verifier in the PKCE flow. The verifier is a high-entropy string that is later used to prove possession of the client that initiated the authorization request.
()
| 35 | // that is later used to prove possession of the client that initiated the |
| 36 | // authorization request. |
| 37 | func generateCodeVerifier() (string, error) { |
| 38 | // Generate 96 random bytes (will result in 128 base64 characters) |
| 39 | bytes := make([]byte, 96) |
| 40 | _, err := rand.Read(bytes) |
| 41 | if err != nil { |
| 42 | return "", fmt.Errorf("failed to generate random bytes: %w", err) |
| 43 | } |
| 44 | |
| 45 | // Encode to URL-safe base64 without padding |
| 46 | return base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(bytes), nil |
| 47 | } |
| 48 | |
| 49 | // generateCodeChallenge creates a code challenge from a given code verifier. |
| 50 | // The challenge is derived by taking the SHA256 hash of the verifier and then |
no test coverage detected