fix: PKCE isSupported method #284
Conversation
aarongranick-okta
commented
Nov 15, 2019
aarongranick-okta
commented
- Check for TextEncoder
- Provider more specific error messages
- Check for TextEncoder - Provider more specific error messages
aarongranick-okta
force-pushed
the
ag-pkce-errors
branch
from
7bf987a to
eb6d29b
Compare
| }; | ||
|
|
||
| proto.features.isHTTPS = function() { | ||
| return window.location.protocol === 'https:'; |
There was a problem hiding this comment.
Should this allow for running on localhost for development purposes?
There was a problem hiding this comment.
This function is only used in reporting errors, so the isPKCESupported() check already failed.
Depending on your browser, the secure webcrypto check will or will not pass on an HTTP localhost url, so if you see this message, the browser will NOT allow HTTP, even for localhost, and there's not much we can do about that.
There was a problem hiding this comment.
@whawker In all browsers I have tested, PKCE will work on http://localhost. (IE does require a TextEncoder polyfill). In most browsers PKCE will fail on HTTP with any origin other than localhost, since crypto.subtle requires a "secure context". Firefox is the exception which seems to allow HTTP domains and crypto.subtle.
