Class: XeroKiwi::OAuth::PKCE

Inherits:
Object
  • Object
show all
Defined in:
lib/xero_kiwi/oauth/pkce.rb

Overview

Implementation of PKCE (Proof Key for Code Exchange — RFC 7636).

PKCE binds the auth code to the original authorisation request: the client generates a random verifier, hashes it into a challenge, sends the challenge with the authorise call, then proves possession of the original verifier when exchanging the code. An attacker that intercepts the auth code can’t redeem it without the verifier.

Required for public OAuth clients (mobile, SPA), recommended for confidential server-side clients as defence in depth.

Constant Summary collapse

CHALLENGE_METHOD = 
"S256"

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(verifier:) ⇒ PKCE

Returns a new instance of PKCE.



28
29
30
31
 
# File 'lib/xero_kiwi/oauth/pkce.rb', line 28

def initialize(verifier:)
  @verifier  = verifier
  @challenge = compute_challenge(verifier)
end

Instance Attribute Details

#challenge ⇒ Object (readonly)

Returns the value of attribute challenge.



22
23
24
 
# File 'lib/xero_kiwi/oauth/pkce.rb', line 22

def challenge
  @challenge
end

#verifier ⇒ Object (readonly)

Returns the value of attribute verifier.



22
23
24
 
# File 'lib/xero_kiwi/oauth/pkce.rb', line 22

def verifier
  @verifier
end

Class Method Details

.generate ⇒ Object 



24
25
26
 
# File 'lib/xero_kiwi/oauth/pkce.rb', line 24

def self.generate
  new(verifier: SecureRandom.urlsafe_base64(32))
end

Instance Method Details

#to_h ⇒ Object 



33
34
35
36
37
38
39
 
# File 'lib/xero_kiwi/oauth/pkce.rb', line 33

def to_h
  {
    code_verifier:         verifier,
    code_challenge:        challenge,
    code_challenge_method: CHALLENGE_METHOD
  }
end