From 0e0866734a72b9062a5e702fd685798a913a64bc Mon Sep 17 00:00:00 2001 From: Rayan Belahcene Date: Sun, 16 Aug 2026 13:15:49 +0200 Subject: [PATCH] hot fix, allow pkce with client secret --- app/core/auth/endpoints_auth.py | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/app/core/auth/endpoints_auth.py b/app/core/auth/endpoints_auth.py index f1bbce3008..b60922a9ad 100644 --- a/app/core/auth/endpoints_auth.py +++ b/app/core/auth/endpoints_auth.py @@ -517,21 +517,23 @@ async def authorization_code_grant( if auth_client.secret is not None: # As PKCE is not used, we need to make sure that PKCE related parameters were not used - if ( - db_authorization_code.code_challenge is not None - or tokenreq.code_verifier is not None - ): - # We allow some auth clients to bypass this verification - # because some auth providers may use PKCE with a client secret event if it's forbidden by the specifications - if not auth_client.allow_pkce_with_client_secret: - hyperion_access_logger.warning( - f"Token authorization_code_grant: PKCE related parameters should not be used when using a client secret ({request_id})", - ) - raise AuthHTTPException( - status_code=400, - error="invalid_request", - error_description="PKCE related parameters should not be used", - ) + # 16/08/2026: As a hotfix, we allow all clients to use PKCE with a client secret + pass + # if ( + # db_authorization_code.code_challenge is not None + # or tokenreq.code_verifier is not None + # ): + # # We allow some auth clients to bypass this verification + # # because some auth providers may use PKCE with a client secret event if it's forbidden by the specifications + # if not auth_client.allow_pkce_with_client_secret: + # hyperion_access_logger.warning( + # f"Token authorization_code_grant: PKCE related parameters should not be used when using a client secret ({request_id})", + # ) + # raise AuthHTTPException( + # status_code=400, + # error="invalid_request", + # error_description="PKCE related parameters should not be used", + # ) elif ( db_authorization_code.code_challenge is not None and tokenreq.code_verifier is not None