OAuth 2.0 & OpenID Connect (OIDC)

export class PkceOAuthClient {
  static async generatePkcePair(): Promise<{ verifier: string; challenge: string }> {
    // 1. Generate random 32-byte array
    const array = new Uint8Array(32);
    crypto.getRandomValues(array);
    const verifier = btoa(String.fromCharCode(...array))
      .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');

    // 2. Hash using Web Crypto API SHA-256
    const encoder = new TextEncoder();
    const digest = await crypto.subtle.digest('SHA-256', encoder.encode(verifier));
    const challenge = btoa(String.fromCharCode(...new Uint8Array(digest)))
      .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');

    return { verifier, challenge };
  }

  static async exchangeToken(
    tokenEndpoint: string,
    clientId: string,
    authCode: string,
    codeVerifier: string,
    redirectUri: string
  ) {
    const params = new URLSearchParams({
      grant_type: 'authorization_code',
      client_id: clientId,
      code: authCode,
      code_verifier: codeVerifier,
      redirect_uri: redirectUri,
    });

    const res = await fetch(tokenEndpoint, {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: params.toString(),
    });
    return await res.json();
  }
}
        

package main

import (
	"crypto/rand"
	"crypto/sha256"
	"encoding/base64"
)

// GeneratePKCE creates a verifier and SHA256 challenge string
func GeneratePKCE() (verifier, challenge string, err error) {
	bytes := make([]byte, 32)
	if _, err := rand.Read(bytes); err != nil {
		return "", "", err
	}
	verifier = base64.RawURLEncoding.EncodeToString(bytes)

	h := sha256.New()
	h.Write([]byte(verifier))
	challenge = base64.RawURLEncoding.EncodeToString(h.Sum(nil))

	return verifier, challenge, nil
}
        

import java.security.SecureRandom;
import java.security.MessageDigest;
import java.util.Base64;
import java.nio.charset.StandardCharsets;

public class PkceUtil {
    public static class PkcePair {
        public final String verifier;
        public final String challenge;
        public PkcePair(String v, String c) { this.verifier = v; this.challenge = c; }
    }

    public static PkcePair generate() throws Exception {
        byte[] randomBytes = new byte[32];
        new SecureRandom().nextBytes(randomBytes);
        String verifier = Base64.getUrlEncoder().withoutPadding().encodeToString(randomBytes);

        MessageDigest md = MessageDigest.getInstance("SHA-256");
        byte[] digest = md.digest(verifier.getBytes(StandardCharsets.US_ASCII));
        String challenge = Base64.getUrlEncoder().withoutPadding().encodeToString(digest);

        return new PkcePair(verifier, challenge);
    }
}
        

#include <iostream>
#include <string>
#include <vector>
#include <openssl/rand.h>
#include <openssl/sha.h>

// Demonstration of PKCE generation with OpenSSL
std::string base64UrlEncode(const unsigned char* input, size_t length);

struct PkcePair {
    std::string verifier;
    std::string challenge;
};

PkcePair generatePkce() {
    unsigned char randomBytes[32];
    RAND_bytes(randomBytes, sizeof(randomBytes));
    std::string verifier = base64UrlEncode(randomBytes, sizeof(randomBytes));

    unsigned char hash[SHA256_DIGEST_LENGTH];
    SHA256(reinterpret_cast<const unsigned char*>(verifier.c_str()), verifier.length(), hash);
    std::string challenge = base64UrlEncode(hash, sizeof(hash));

    return { verifier, challenge };
}