Add PKCE support to OIDC Middleware

[mraible]

I'm submitting this issue for the package(s):

• jwt-verifier
• okta-angular
• oidc-middleware
• okta-react
• okta-react-native
• okta-vue

I'm submitting a:

• Bug report
• Feature request
• Other (Describe below)

Current behavior

Is it possible to use this library with PKCE and no client secret? That'd be a cool feature, IMHO. 🙂

[swiftone]

@mraible - Can you expand on this a bit so we can determine priority? PKCE is normally SPA-based, what is the use case for this?

[mraible]

The use case is it makes developers less likely to leak a client secret if there isn't one involved. Also, our Spring Boot starter will support it soon. okta/okta-spring-boot#132

…

On May 29, 2020, at 12:58, Brett Ritter ***@***.***> wrote:  @mraible - Can you expand on this a bit so we can determine priority? PKCE is normally SPA-based, what is the use case for this? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.

[aaronpk]

fwiw PKCE is not an alternative to a client secret and should always be included even for server-side apps with a client secret.

https://oauth.net/2/pkce/

https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-19#section-2.1.1