codeVerifier not initialized in dbx.auth.getAccessTokenFromCode

---

SosiOne wrote:

... But if I look at where the error comes from, there is a check:

 

if (!this.codeVerifier) {
throw new Error('You must use PKCE when generating the authorization URL to not include a client secret');
}

 

so I suppose that something is not set up correctly here.

...

---

Hi SosiOne,

Yes, exactly - there is something wrong. 🙂 You are probably unaware how PKCE  works. Key moment is to avoid a "man in the middle" during authorization. That's why pair of values are generated - code challenge and code verifier. They are passed during first and second step of the process. Only you (your application actually) is aware about values. In such a way the "man in the middle" (potential attacker) cannot stеal the authorization (possible stealed code is unusable, as in your case). The state should be kept during the process, so the values don't get lost, but you're using new object on the second step - for sure your codeVerifier is lost now (it's clear). Probably you don't understand that you have tried to impersonate yourself as attacker unintentionally (even the impersonation is incomplete and that's why consistency check catch it). Even if you pass that check the server will stop you - the value wouldn't match.

Restructure your code, so the client object stay from the start to the end of OAuth flow and use the same object in both steps. 😉

Hope this helps.