🚀 Feature: Enable PKCE by default #47

New Issue

OVERLORD · 2025-10-06T23:59:17+03:00

OVERLORD commented

2025-10-06 23:59:17 +03:00

Originally created by @vanillajonathan on GitHub.

Feature description

When creating a new client the PKCE option should be enabled by default.

Pitch

To follow best practices, avoid misconfiguration, and to be secure by default.

Originally created by @vanillajonathan on GitHub. ### Feature description When creating a new client the PKCE option should be enabled by default. ### Pitch To follow best practices, avoid misconfiguration, and to be secure by default.

OVERLORD closed this issue

2025-10-06 23:59:18 +03:00

OVERLORD commented

2025-10-06 23:59:20 +03:00

@vanillajonathan commented on GitHub:

Similarly many OIDC clients enable PKCE by default.

c821481c64/src/Security/Authentication/OpenIdConnect/src/OpenIdConnectOptions.cs (L339)

@vanillajonathan commented on GitHub: Similarly many OIDC clients enable PKCE by default. https://github.com/dotnet/aspnetcore/blob/c821481c641a08274e8bf9743eed10d1475d2c6b/src/Security/Authentication/OpenIdConnect/src/OpenIdConnectOptions.cs#L339

OVERLORD commented

2025-10-06 23:59:22 +03:00

@stonith404 commented on GitHub:

Many OIDC clients don’t support PKCE. If we make PKCE the default, users who aren’t familiar with it may run into configuration problems and find that their clients don’t work. Since enabling PKCE is just a single click, it may be better to leave it as an optional setting.

@stonith404 commented on GitHub: Many OIDC clients don’t support PKCE. If we make PKCE the default, users who aren’t familiar with it may run into configuration problems and find that their clients don’t work. Since enabling PKCE is just a single click, it may be better to leave it as an optional setting.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/pocket-id#47