karatelabs/karate · error · OAuth2Exception

Failed to generate code challenge

Error message

Failed to generate code challenge

What it means

PkceGenerator throws this wrapped OAuth2Exception when the SHA-256 code-challenge computation fails for an S256 PKCE flow. It wraps any Exception from MessageDigest.getInstance("SHA-256") or digesting, which on a normal JVM should never occur since SHA-256 is mandatory for every JRE. The underlying cause is attached as the exception's cause.

Solutions

1. Inspect the exception's cause (getCause()) to identify the actual NoSuchProviderException/NoSuchAlgorithmException.
2. Verify the JVM's security providers include one supplying SHA-256 (check java.security file and Security.getProviders()).
3. Restore or register a standard provider (e.g.SUN) in java.security or via Security.insertProviderAt().
4. If using a jlink/pruned runtime, include the jdk.crypto.ec / crypto modules.
5. As a last resort use PKCE method "plain" if the authorization server supports it.

Example fix

// before (stripped runtime)
java --list-modules  // jdk.crypto.ec missing
// after
jlink --add-modules java.base,jdk.crypto.ec --output custom-runtime

// Java
boolean ok = false;
try { MessageDigest.getInstance("SHA-256"); ok = true; } catch (Exception ignored) {}

try {
    String challenge = PkceGenerator.challenge(verifier, "S256");
} catch (OAuth2Exception e) {
    logger.error("PKCE crypto failure", e.getCause());
    throw new IllegalStateException("JVM lacks SHA-256 support", e);
}

When it happens

Trigger: Calling PkceGenerator.challenge(verifier, "S256") (via generateCodeChallenge) in a JVM environment where the SHA-256 MessageDigest algorithm is not available from the configured security provider — e.g. a stripped-down/custom JRE, a broken JCE provider registration, or a security policy restricting crypto algorithms.

Common situations: Running Karate on hardened FIPS-only JVMs where SHA-256 is mapped to a different name; custom or removed java.security security providers; severely pruned runtime images (custom jlink builds missing crypto modules).

Understand the failure class

Background: "not installed", "pip install", "required for": how missing-dependency errors surface across open-source libraries — this error's family across 34 libraries.

Related errors

• Authorization flow failed: " + e.getMessage()
• URL encoding failed
• Unsupported PKCE method:
• failed to start debug server
• failed to load private key: unsupported algorithm

AI-assisted analysis of karatelabs/karate@a22eb90246 (2026-09-12). Data as JSON: /api/errors/24411f7513a9ad42. Report an issue: GitHub.

Appendix: source

Thrown at karate-core/src/main/java/io/karatelabs/http/PkceGenerator.java:64

        byte[] bytes = new byte[32];
        random.nextBytes(bytes);
        return base64UrlEncode(bytes);
    }

    /**
     * Generate code challenge from verifier
     */
    private static String generateCodeChallenge(String verifier, String method) {
        if ("plain".equals(method)) {
            return verifier;
        }
        if ("S256".equals(method)) {
            try {
                MessageDigest digest = MessageDigest.getInstance("SHA-256");
                byte[] hash = digest.digest(verifier.getBytes(StandardCharsets.US_ASCII));
                return base64UrlEncode(hash);
            } catch (Exception e) {
                throw new OAuth2Exception("Failed to generate code challenge", e);
            }
        }
        throw new IllegalArgumentException("Unsupported PKCE method: " + method);
    }

    /**
     * Base64-URL encoding without padding
     */
    private static String base64UrlEncode(byte[] data) {
        return Base64.getUrlEncoder()
            .withoutPadding()
            .encodeToString(data);
    }

    public String getVerifier() { return verifier; }
    public String getChallenge() { return challenge; }
    public String getMethod() { return method; }
}

View on GitHub (pinned to a22eb90246)