DMC/oauth2-authorization-server
0
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

Enable public clients to exchange codes for access tokens #14

Manually merged
ansv7779 merged 1 commits from public-client-token-exchange into main 2026-02-20 09:21:13 +01:00
Conversation 1 Commits 1 Files Changed 2 +76 -2
ansv7779 commented 2026-02-17 14:31:48 +01:00
Owner
Copy Link

Public clients are intended to be supported with PKCE as a requirement. However, since exchanging the authorization code for a token is a cross-origin POST request it will be blocked due to lack of a CORS policy.

This change introduces a CORS policy for just the token exchange endpoint where POST is allowed.

Public clients are intended to be supported with PKCE as a requirement. However, since exchanging the authorization code for a token is a cross-origin POST request it will be blocked due to lack of a CORS policy. This change introduces a CORS policy for just the token exchange endpoint where POST is allowed.
ansv7779 added 1 commit 2026-02-17 14:31:49 +01:00
Enable public clients to exchange codes for access tokens
All checks were successful
/ build (push) Successful in 2m0s
Details
3eeb5d7801 
Public clients are intended to be supported with PKCE as a requirement. However, since exchanging the authorization code for a token is a cross-origin POST request it will be blocked due to lack of a CORS policy.

This change introduces a CORS policy for just the token exchange endpoint where POST is allowed.
ansv7779 force-pushed public-client-token-exchange from 3eeb5d7801 to 6db1ce23d1 2026-02-18 13:46:28 +01:00 Compare
ansv7779 requested review from stne3960 2026-02-18 15:49:08 +01:00
stne3960 approved these changes 2026-02-19 14:10:00 +01:00
ansv7779 manually merged commit e20d7e7dd4 into main 2026-02-20 09:21:13 +01:00
ansv7779 deleted branch public-client-token-exchange 2026-02-20 09:21:26 +01:00
Sign in to join this conversation.
Reviewers
No Reviewers
stne3960
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DMC/oauth2-authorization-server#14
No description provided.
Delete Branch "public-client-token-exchange"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?