25 lines
673 B
Go
25 lines
673 B
Go
|
package auth
|
||
|
|
|
||
|
|
import (
|
||
|
|
"crypto/rand"
|
||
|
|
"crypto/sha256"
|
||
|
|
"encoding/base64"
|
||
|
|
)
|
||
|
|
|
||
|
|
// GenerateVerifier returns a cryptographically random PKCE verifier (RFC 7636).
|
||
|
|
// Length is 64 URL-safe characters, within the required [43, 128] range.
|
||
|
|
func GenerateVerifier() (string, error) {
|
||
|
|
b := make([]byte, 48)
|
||
|
|
if _, err := rand.Read(b); err != nil {
|
||
|
|
return "", err
|
||
|
|
}
|
||
|
|
return base64.RawURLEncoding.EncodeToString(b), nil
|
||
|
|
}
|
||
|
|
|
||
|
|
// ChallengeS256 returns the S256 PKCE challenge for the given verifier.
|
||
|
|
// challenge = BASE64URL(SHA256(ASCII(verifier)))
|
||
|
|
func ChallengeS256(verifier string) string {
|
||
|
|
h := sha256.Sum256([]byte(verifier))
|
||
|
|
return base64.RawURLEncoding.EncodeToString(h[:])
|
||
|
|
}
|