Consider adding new options to force PKCE globally and per-application

[AngularAdvisers]

Authorization Code Flow with PKCE (Proof Key for Code Exchange) is a mechanism that came into being to make the use of OAuth 2.0 Authorization Code grant more secure.

When building applications and integrating a user signing and getting access to some resource, one of the main go-to standards is OAuth 2 with the usage of the Authorization Code grant type. Those who know the flow of Auth Code grant type knows that the first call(authorization request) is made through a browser(User-Agent) to obtain the authorization code. This makes the auth code susceptible to an “Authorization Code Interception Attack”. In simple, there is a chance some on could steel that auth code.

PKCE introduces few new things to the Auth Code flow; a code verifier, a code challenge and a code challenge method.

So the basic flow is like this.

• The client sends the authorization request along with the code_challenge and the code_challenge_method.
• The Authorization Server makes note of the code_challenge and the code_challenge_method and issues an authz code.
• The client sends an access token request along with the code_verifier.
• The Authorization Server validates the code_verifier with the already received code_challenge and the code_challenge_method and issues an access token if the validation is successful.

reference: https://tools.ietf.org/html/rfc7636

[kevinchalet]

PKCE is already fully supported by the OpenID module (support has been added to ASOS/OpenIddict in April 2016).

What's not offered yet by the OpenID module is the ability to either:

• Force PKCE globally. This can be done by setting this option to true: https://github.com/openiddict/openiddict-core/blob/c5a02a3b17f51be2c993942eb953d899163d8cc0/src/OpenIddict.Server/OpenIddictServerOptions.cs#L322-L328

• Force PKCE per-application. This can be done by adding OpenIddictConstants.Requirements.Features.ProofKeyForCodeExchange to the Requirements collection: https://github.com/openiddict/openiddict-core/blob/c5a02a3b17f51be2c993942eb953d899163d8cc0/src/OpenIddict.Abstractions/Descriptors/OpenIddictApplicationDescriptor.cs#L55-L58

I'm going to change the title to reflect that. @AngularAdvisers would you like to send a PR to implement that in the UI?