make PKCE easier

Author: hickford

authhandler/authhandler.go

@@ -22,12 +22,7 @@ const (
 	codeVerifierKey = "code_verifier"
 )
 
-// PKCEParams holds parameters to support PKCE.
-type PKCEParams struct {
-	Challenge       string // The unpadded, base64-url-encoded string of the encrypted code verifier.
-	ChallengeMethod string // The encryption method (ex. S256).
-	Verifier        string // The original, non-encrypted secret.
-}
+type PKCEParams = oauth2.PKCEParams
 
 // AuthorizationHandler is a 3-legged-OAuth helper that prompts
 // the user for OAuth consent at the specified auth code URL

oauth2.go

@@ -11,7 +11,11 @@ package oauth2 // import "golang.org/x/oauth2"
 import (
 	"bytes"
 	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
 	"errors"
+	"io"
 	"net/http"
 	"net/url"
 	"strings"
@@ -379,3 +383,50 @@ func ReuseTokenSource(t *Token, src TokenSource) TokenSource {
 		new: src,
 	}
 }
+
+// PKCEParams holds parameters to support PKCE.
+type PKCEParams struct {
+	Challenge       string // The unpadded, base64-url-encoded string of the encrypted code verifier.
+	ChallengeMethod string // The encryption method (ex. S256).
+	Verifier        string // The original, non-encrypted secret.
+}
+
+const (
+	// Parameter keys for AuthCodeURL method to support PKCE.
+	codeChallengeKey       = "code_challenge"
+	codeChallengeMethodKey = "code_challenge_method"
+
+	// Parameter key for Exchange method to support PKCE.
+	codeVerifierKey = "code_verifier"
+)
+
+func (p *PKCEParams) AuthCodeOptions() []AuthCodeOption {
+	return []AuthCodeOption{
+		SetAuthURLParam(codeChallengeKey, p.Challenge),
+		SetAuthURLParam(codeChallengeMethodKey, p.ChallengeMethod)}
+}
+
+func (p *PKCEParams) ExchangeOptions() []AuthCodeOption {
+	return []AuthCodeOption{
+		SetAuthURLParam(codeVerifierKey, p.Verifier)}
+}
+
+func randomString(n int) string {
+	data := make([]byte, n)
+	if _, err := io.ReadFull(rand.Reader, data); err != nil {
+		panic(err)
+	}
+	return base64.StdEncoding.EncodeToString(data)
+}
+
+func GeneratePKCEParams() *PKCEParams {
+	verifier := randomString(32)
+	sha := sha256.Sum256([]byte(verifier))
+	challenge := base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(sha[:])
+
+	return &PKCEParams{
+		Challenge:       challenge,
+		ChallengeMethod: "S256",
+		Verifier:        verifier,
+	}
+}