how to disable pkce flow?

[vetsinen-onlyfans]

I try to disable pkce usage by setting option pkce: false, but when see strategy, pkce still is ictive my code:

const twitterStrategy =     // <2> Strategy initialization
    new Strategy(
        {
            clientID: process.env.TWITTER_CLIENT_ID,
            clientSecret: process.env.TWITTER_CLIENT_SECRET,
            clientType: 'public',
            callbackURL,
            pkce: false,
        },
        // <3> Verify callback
        (accessToken, refreshToken, profile, done) => {
            console.log('Success!', { accessToken, refreshToken });
            return done(null, profile);
        }
    )
console.dir(twitterStrategy);

but twitterStrategy is, and it seems that pkce is on

Strategy {
  name: 'twitter',
  _verify: [Function (anonymous)],
  _oauth2: {
    _clientId: 'Z3lZMlFzMHZocnIwbmtZc001Zmo6MTpjaQ',
    _clientSecret: '9E2rUQlpQKuVwKAWpnLcJb53IxjSfhQiZA9sHYwfmB4yOFya1u',
    _baseSite: '',
    _authorizeUrl: 'https://twitter.com/i/oauth2/authorize',
    _accessTokenUrl: 'https://api.twitter.com/2/oauth2/token',
    _accessTokenName: 'access_token',
    _authMethod: 'Bearer',
    _customHeaders: {
      Authorization: 'Basic WjNsWk1sRnpNSFpvY25Jd2JtdFpjMDAxWm1vNk1UcGphUTo5RTJyVVFscFFLdVZ3S0FXcG5MY0piNTNJeGpTZmhRaVpBOXNIWXdmbUI0eU9GeWExdQ=='
    },
    _useAuthorizationHeaderForGET: false,
    _agent: undefined
  },
  _callbackURL: 'http://127.0.0.1:3000/social/callback/twitter',
  _scope: undefined,
  _scopeSeparator: ' ',
  _pkceMethod: 'S256',
  _key: 'oauth:twitter',
  _stateStore: PKCESessionStore { _key: 'oauth:twitter' },
  _trustProxy: undefined,
  _passReqToCallback: undefined,
  _skipUserProfile: false,
  _userProfileURL: 'https://api.twitter.com/2/users/me?user.fields=profile_image_url,url'
}

[janhalama]

PKCE is required by Twitter as OAuth2 provider. You can not authenticate with disabled PKCE.

We only provide authorization code with PKCE and refresh token as the supported grant types for this initial launch. We may provide more grant types in the future.

For more information see: https://developer.twitter.com/en/docs/authentication/oauth-2-0/authorization-code

Why do you want to disable PKCE? Is there anything that I missed?

[vetsinen-onlyfans]

i have app with separated frontend and backend and i try to implement twitter login. google and twitch login works ok, but there is a problem to make twitter login work, so i hoped that oauth 2 can work without pkce

PKCE is required by Twitter as OAuth2 provider. You can not authenticate with disabled PKCE.

We only provide authorization code with PKCE and refresh token as the supported grant types for this initial launch. We may provide more grant types in the future.

For more information see: https://developer.twitter.com/en/docs/authentication/oauth-2-0/authorization-code

Why do you want to disable PKCE? Is there anything that I missed?

i

[jnv]

I suspect this issue is just another aspect of the problem you reported in #36. Twitter OAuth 2.0 requires PKCE and PKCE requires session storage (express-session), so please check if you have it configured correctly. Consider also changing the clientType to confidential, since in your case it's a server handling the authorization flow, not the client application.

If I'm not mistaken, I think Google OAuth flow can be implemented without reliance on session, but I think it requires explicitly disabling state.