{"record":{"id":"eb1c92f71b7dd8cf","repo":"karatelabs/karate","slug":"unsupported-pkce-method","errorCode":null,"errorMessage":"Unsupported PKCE method: ","messagePattern":"Unsupported PKCE method: ","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"karate-core/src/main/java/io/karatelabs/http/PkceGenerator.java","lineNumber":67,"sourceCode":"    }\n\n    /**\n     * Generate code challenge from verifier\n     */\n    private static String generateCodeChallenge(String verifier, String method) {\n        if (\"plain\".equals(method)) {\n            return verifier;\n        }\n        if (\"S256\".equals(method)) {\n            try {\n                MessageDigest digest = MessageDigest.getInstance(\"SHA-256\");\n                byte[] hash = digest.digest(verifier.getBytes(StandardCharsets.US_ASCII));\n                return base64UrlEncode(hash);\n            } catch (Exception e) {\n                throw new OAuth2Exception(\"Failed to generate code challenge\", e);\n            }\n        }\n        throw new IllegalArgumentException(\"Unsupported PKCE method: \" + method);\n    }\n\n    /**\n     * Base64-URL encoding without padding\n     */\n    private static String base64UrlEncode(byte[] data) {\n        return Base64.getUrlEncoder()\n            .withoutPadding()\n            .encodeToString(data);\n    }\n\n    public String getVerifier() { return verifier; }\n    public String getChallenge() { return challenge; }\n    public String getMethod() { return method; }\n}\n","sourceCodeStart":49,"sourceCodeEnd":83,"githubUrl":"https://github.com/karatelabs/karate/blob/a22eb90246d958d15a47bf436693d0121ad2812d/karate-core/src/main/java/io/karatelabs/http/PkceGenerator.java#L49-L83","documentation":"PkceGenerator.generateCodeChallenge only supports the \"S256\" PKCE transformation; any other method value is rejected with this IllegalArgumentException. RFC 7636 defines \"plain\" and \"S256\", and this implementation intentionally only implements S256. The method string is interpolated into the message.","triggerScenarios":"Calling PkceGenerator.challenge(verifier, method) with method != \"S256\" — e.g. \"plain\", \"s256\" (wrong case), null, or a typo like \"S-256\".","commonSituations":"Configuring an OAuth2 client copied from a legacy example that used the deprecated \"plain\" method; passing a method value from external config with different casing; hand-written PKCE setup code guessing the method name.","solutions":["Pass exactly \"S256\" (case-sensitive) as the PKCE method.","If the auth server only supports \"plain\", compute the challenge yourself (verifier is the challenge) instead of using PkceGenerator.","Check the configured value comes from config/environment and normalize it (trim, uppercase) before calling.","Null-check the method before calling if it is externally supplied."],"exampleFix":"// before\nString challenge = PkceGenerator.challenge(verifier, \"plain\");\n// after\nString challenge = PkceGenerator.challenge(verifier, \"S256\");","handlingStrategy":"validation","validationCode":"// Java\nif (!\"S256\".equals(method)) throw new IllegalArgumentException(\"Only S256 PKCE is supported, got: \" + method);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass the literal \"S256\"","Normalize external config (trim/uppercase) before use","Keep the PKCE method constant in one place","Don't copy legacy \"plain\"-method examples"],"tags":["oauth2","pkce","invalid-argument"],"backgroundTag":"unsupported-enum-value","analyzedSha":"a22eb90246d958d15a47bf436693d0121ad2812d","analyzedAt":"2026-09-12T09:01:00.220Z","contentChangedAt":"2026-09-12T09:01:00.220Z","schemaVersion":2},"datasetVersion":"2026-09-16T19:17:19.609Z"}