pkce-challenge

What is pkce-challenge?

The pkce-challenge npm package is used to generate PKCE (Proof Key for Code Exchange) challenge and verifier pairs. PKCE is a security extension for OAuth 2.0 to prevent authorization code interception attacks.

What are pkce-challenge's main functionalities?

Generate PKCE Challenge and Verifier

This feature allows you to generate a PKCE challenge and verifier pair. The code_verifier is a high-entropy cryptographic random string, and the code_challenge is a Base64 URL-encoded SHA256 hash of the code_verifier.

const pkceChallenge = require('pkce-challenge');
const { code_verifier, code_challenge } = pkceChallenge();
console.log('Code Verifier:', code_verifier);
console.log('Code Challenge:', code_challenge);

Other packages similar to pkce-challenge

oauth-pkce

The oauth-pkce package provides similar functionality for generating PKCE challenge and verifier pairs. It also includes additional utilities for handling OAuth 2.0 PKCE flows. Compared to pkce-challenge, oauth-pkce offers more comprehensive support for the entire PKCE flow.

pkce

The pkce package is another alternative for generating PKCE challenge and verifier pairs. It is lightweight and straightforward, similar to pkce-challenge, but may have fewer features and less community support.

README

pkce-challenge

Generate or verify a Proof Key for Code Exchange (PKCE) challenge pair.

Read more about PKCE.

Installation

npm install pkce-challenge

Usage

Default length for the verifier is 43

import pkceChallenge from 'pkce-challenge'
// or require with commonjs
const pkceChallenge = require("pkce-challenge").default;

pkceChallenge();

gives something like:

{
    code_verifier: 'u1ta-MQ0e7TcpHjgz33M2DcBnOQu~aMGxuiZt0QMD1C',
    code_challenge: 'CUZX5qE8Wvye6kS_SasIsa8MMxacJftmWdsIA_iKp3I'
}

Specify a verifier length

const challenge = pkceChallenge(128);

challenge.code_verifier.length === 128; // true

Challenge verification

import { verifyChallenge } from "pkce-challenge";

verifyChallenge(challenge.code_verifier, challenge.code_challenge) === true; // true

Challenge generation from existing code verifier

import { generateChallenge } from "pkce-challenge";

generateChallenge(challenge.code_verifier) === challenge.code_challenge; // true

Changelog

4.0.0 - 2023-05-11

• BREAKING CHANGE: Use Web Cryptography API (#20), closes #21, #18

Contributors

• saschanaz