Is it a good idea to add pkce support?

[Jazzgeir]

Using a client generated state is a nice feature, but it'd be also very nice to add the PKCE server side security too!

The task at hand:

1. Create a code_challenge
2. Create a code_verifier
3. Store code_verifier in session
4. Send code_challenge and code_challenge_method (S256?) to authority server when requesting auth code
5. On return from authority server, Proceed as normal, checking state etc
6. Send code_verifier when exchanging auth code for auth token
   Voilà!

[bradjones1]

This project is minimally maintained. I would suggest looking at https://oauth2-client.thephpleague.com/

[Jazzgeir]

OK, fair enough. :-) Thanks for the pointer!