Skip to content

[Hot fix] Allow pkce with client secret #1046

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
NakoGH merged 1 commit into from
Aug 16, 2026
Merged

[Hot fix] Allow pkce with client secret #1046

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 17 additions & 15 deletions app/core/auth/endpoints_auth.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -517,21 +517,23 @@ async def authorization_code_grant(

if auth_client.secret is not None:
# As PKCE is not used, we need to make sure that PKCE related parameters were not used
if (
db_authorization_code.code_challenge is not None
or tokenreq.code_verifier is not None
):
# We allow some auth clients to bypass this verification
# because some auth providers may use PKCE with a client secret event if it's forbidden by the specifications
if not auth_client.allow_pkce_with_client_secret:
hyperion_access_logger.warning(
f"Token authorization_code_grant: PKCE related parameters should not be used when using a client secret ({request_id})",
)
raise AuthHTTPException(
status_code=400,
error="invalid_request",
error_description="PKCE related parameters should not be used",
)
# 16/08/2026: As a hotfix, we allow all clients to use PKCE with a client secret
pass
# if (
# db_authorization_code.code_challenge is not None
# or tokenreq.code_verifier is not None
# ):
# # We allow some auth clients to bypass this verification
# # because some auth providers may use PKCE with a client secret event if it's forbidden by the specifications
# if not auth_client.allow_pkce_with_client_secret:
# hyperion_access_logger.warning(
# f"Token authorization_code_grant: PKCE related parameters should not be used when using a client secret ({request_id})",
# )
# raise AuthHTTPException(
# status_code=400,
# error="invalid_request",
# error_description="PKCE related parameters should not be used",
# )
elif (
db_authorization_code.code_challenge is not None
and tokenreq.code_verifier is not None
Expand Down
Loading