Class PkceChallenge
Validates PKCE code challenges and checks code verifiers against them (RFC 7636 with the S256 method, which is the only one supported).
Namespace: Singulink.Net.Http.Api.Service.SignIn
Assembly: Singulink.Net.Http.Api.Service.dll
Syntax
public static class PkceChallengeRemarks
A client creates a random code verifier, sends the challenge derived from it when a flow starts, and proves it started the flow by presenting the verifier
when the flow finishes. Whoever intercepts something in between (a one-time code, a credential passed through a redirect) cannot finish the flow without
the verifier. Singulink.Net.Http.Api.Client.Pkce creates matching verifiers and challenges on the client.
Fields
| Name | Description |
|---|---|
| Length | The length of a valid code challenge: the 43 base64url characters (without padding) of a SHA-256 hash. |
Methods
| Name | Description |
|---|---|
| EnsureValid(string?) | Throws a BadRequestApiException if the value is not a well-formed code challenge (see IsValid(string?)), so that a request can be checked up front with the same rules the sign-in building blocks apply. |
| IsMatch(string, string) | Gets a value indicating whether the code verifier matches the code challenge, i.e. the challenge is the base64url encoded SHA-256 hash of the verifier. Returns false if either value is malformed. The comparison takes the same time regardless of how much of the hash matches. |
| IsValid(string?) | Gets a value indicating whether the specified value is a well-formed |