Facebook PKCE OIDC

[Mardoxx]

https://developers.facebook.com/docs/facebook-login/guides/advanced/oidc-token/

https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/

import { CodeChallengeMethod, OAuth2Client, OAuth2Tokens } from "arctic";

const authorizationEndpoint = "https://www.facebook.com/v21.0/dialog/oauth";
const tokenEndpoint = "https://graph.facebook.com/v21.0/oauth/access_token";

export class Facebook {
  private client: OAuth2Client;

  constructor(clientId: string, clientSecret: string, redirectURI: string) {
    this.client = new OAuth2Client(clientId, clientSecret, redirectURI);
  }

  public createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): URL {
    const url = this.client.createAuthorizationURLWithPKCE(
      authorizationEndpoint,
      state,
      CodeChallengeMethod.S256,
      codeVerifier,
      scopes
    );
    return url;
  }

  public async validateAuthorizationCode(
    code: string,
    codeVerifier: string
  ): Promise<OAuth2Tokens> {
    const tokens = await this.client.validateAuthorizationCode(tokenEndpoint, code, codeVerifier);
    return tokens;
  }
}

Scopes e.g. ["openid", "public_profile"]

Token revocation I can't find, they recommend revoking the entire app's permissions which is a DELETE request
https://developers.facebook.com/docs/facebook-login/guides/permissions/request-revoke#revokelogin

[pilcrowonpaper]

I'm guessing this is a feature request to add PKCE support to Facebook? I was putting it off since Facebook's OIDC docs seem outdated