DefaultPKCEProvider challenge rejected

Environment details

Meet (but not API-specific)
OS type and version: Linux
Java version: OpenJDK 17
version(s):

Steps to reproduce

Create a UserAuthorizer with PKCE enabled
Open authorization URL in browser

Code example

      UserAuthorizer authorizer = UserAuthorizer.newBuilder()
          .setClientId(clientId)
          .setCallbackUri(callbackUri)
          .setScopes(SCOPES)
          .setPKCEProvider(new DefaultPKCEProvider())
          .build()
      URL authorizationUrl = authorizer.getAuthorizationUrl("me" "", null);
      System.out.printf("Open the following URL to authorize access: %s\n",
          authorizationUrl.toExternalForm());

Stack trace

None. Error is when attempting authorization, fails with error:

Access blocked: Authorization Error

Code Challenge must be base64 encoded. Learn more about this error

External references such as API reference guides

https://www.rfc-editor.org/rfc/rfc7636

Any additional information below

Following these steps guarantees the quickest resolution possible.

Thanks!

Looks like the issue is padding. PKCE spec calls for having the padding stripped (https://www.rfc-editor.org/rfc/rfc7636#appendix-A) whereas the URL generated with the DefaultPkCEProvider has padding included (the trailing %3D in the challenge):

https://accounts.google.com/o/oauth2/auth?response_type=code&client_id=1091545035118-1fgup6gnafl7fhneispbln4rt6olmb19.apps.googleusercontent.com&redirect_uri=http://localhost:38377/Callback&scope=https://www.googleapis.com/auth/meetings.space.created&state&access_type=offline&approval_prompt=force&login_hint=default&include_granted_scopes=true&code_challenge=Wv7S82_ZOSlisom9x4K_qljSAb0LTPSjUogEz8Aq08E%3D&code_challenge_method=S256

And verified that removing the padding fixes the issues:

.setPKCEProvider(new DefaultPKCEProvider() {
  @Override
   public String getCodeChallenge() {
     return super.getCodeChallenge().split("=")[0];
   }
})

@clundin25

@clundin25 Could you please take a look, maybe applies to other langs?

fix: Remove Base64 padding in DefaultPKCEProvider

@sqrrrl

Thanks for pointing this out @sqrrrl ! I have opened #1375 to address this issue.

fix: Remove Base64 padding in DefaultPKCEProvider (googleapis#1375)

fix: Remove Base64 padding in DefaultPKCEProvider (#1375)

Navigation Menu

Repository navigation

DefaultPKCEProvider challenge rejected #1373

Environment details

Steps to reproduce

Code example

Stack trace

External references such as API reference guides

Any additional information below

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

DefaultPKCEProvider challenge rejected #1373

Description

Environment details

Steps to reproduce

Code example

Stack trace

External references such as API reference guides

Any additional information below

Activity

sqrrrl commented on Mar 7, 2024

sqrrrl commented on Mar 7, 2024

TimurSadykov commented on Mar 7, 2024

clundin25 commented on Mar 11, 2024

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions