Add PKCE and handle the passkey enrollment screen in the auth flow - #96
Merged
Conversation
Auth0 has changed the Porsche login flow in two ways that the current implementation does not handle. The authorization request now sends a PKCE challenge (RFC 7636). The verifier is generated before /authorize and kept on the OAuth2Client so it survives a captcha round trip, since the challenge is bound to the Auth0 transaction created by that request. It is sent with the code exchange at the token endpoint. The resume URL returned by the Identifier First flow no longer redirects straight to the callback. Porsche can interleave an optional passkey enrollment screen, so the redirect chain is walked until the authorization code appears, declining enrollment when that screen shows up. PorscheExceptionError also carries the response body and request URL now, so failures at the token endpoint report what the server actually said instead of a bare status code. Co-authored-by: tietjen <tietjen@users.noreply.github.com>
CJNE
approved these changes
Aug 31, 2026
CJNE
left a comment
CJNE
left a comment
Owner
There was a problem hiding this comment.
It's looking good, i've tested it as well and seems to work fine, nice job!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The login flow in later versions of the app is changed in two ways that the current implementation does not handle.
The authorization request now sends a PKCE challenge (RFC 7636).
The flow interleaves an optional passkey enrollment screen that need to be declined.
PorscheExceptionError now also carries the response body and request URL, so failures at the token endpoint report what the server actually said instead of a bare status code.
This PR breaks out and refactors core parts of #84.