help menu

Join us on the Community Forums!

  • Community Guidelines

    The Fitbit Community is a gathering place for real people who wish to exchange ideas, solutions, tips, techniques, and insight about the Fitbit products and services they love. By joining our Community, you agree to uphold these guidelines, so please take a moment to look them over.

  • Learn the Basics

    Check out our Frequently Asked Questions page for information on Community features, and tips to make the most of your time here.

  • Join the Community!

    Join an existing conversation, or start a new thread to ask your question. Creating your account is completely free, and takes about a minute.

Not finding your answer on the Community Forums?

Cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Override the Code Challenge Method for OAuth Button in Settings API

‎02-25-2021 11:46

‎02-25-2021 11:46

I'm trying to implement the OAuth settings component using the Authorization Code Flow w/ PKCE with my OAuth provider. It almost works, except that the `code_challenge_method` parameter is set to "plain", which isn't supported in a few identity services like Auth0 or Okta.

 

Is there any support on this or should I resort to using the client credentials flow (client id and secret). If I do with the client credentials flow, is it safe to assume that the client secret can be safely hard-coded without being exposed?

 

Help is much appreciated, thank you!

Creator of Pixels on Ridge. Just building fun stuff. Check out some of my Fitbit libraries like fitbit-settings or fitbit-core to help accelerate your development.
Best Answer
0 Votes
3 REPLIES 3

‎03-10-2021 16:58

‎03-10-2021 16:58

Hi @brh55,

 

If your client supports it, I recommend that your code_challenge_method be hashed with SHA256. While "plain" is supported, it's not actually recommended as it does not mitigate as wide a range of attacks as SHA256. You can check the RFC documentation here.

 

I hope this helps. Let me know if you have additional questions.

Best Answer

‎03-10-2021 17:18

In response to JohnFitbit

‎03-10-2021 17:18

Sorry @JohnFitbit !

I thought I had posted this on the SDK Development forum . This question is more-so around the OAuth Settings component for developing Fitbit devices applications.

Creator of Pixels on Ridge. Just building fun stuff. Check out some of my Fitbit libraries like fitbit-settings or fitbit-core to help accelerate your development.
Best Answer

‎03-10-2021 17:27

In response to brh55

‎03-10-2021 17:27

@brh55 No worries, though if it helps clarify further, we actually cover this topic in our Web API documentation at https://dev.fitbit.com/build/reference/web-api/oauth2/#authorization-code-grant-flow-with-pkce too.

Best Answer
0 Votes