omniauth / omniauth-oauth2 / 39707114295

100%

push

github

Stop keeping the PKCE verifier in options

The pkce_verifier option looked configurable, but the strategy
overwrote it with a fresh verifier on every request, so it was really
scratch space for the current request. Generate the verifier as a
local and store it straight in the session instead, and remove the
option. RFC 7636 requires a fresh verifier for every authorization
request, so it shouldn't be configurable.

Follows up on https://github.com/omniauth/omniauth-oauth2/pull/184

22 of 22 branches covered (100.0%)

Branch coverage included in aggregate %.

3 of 3 new or added lines in 1 file covered. (100.0%)

100 of 100 relevant lines covered (100.0%)

13.55 hits per line