[5.x] Make PKCE opt-in

[driesvints]

This makes #518 opt-in since it seems to be breaking apps using the Google provider in API's.

Fixes #522

[aaronpk]

See my comments in #522 before merging this. Stateless apps can't use the OAuth authorization flow at all it requires maintaining application state in order to check the OAuth state parameter as well as the new PKCE parameters.

[driesvints]

Converting to draft until we've gotten to the bottom of this.

[driesvints]

@aaronpk I'm going to go ahead with this PR by disabling PKCE by default and making it opt-in since this seems to break apps using the Google Provider in an API: #524 #522

Until we've fully figured out what's causing this we should keep it opt-in.

[aaronpk]

Okay I've reviewed everything again, and I'm guessing that people who are using this from a stateless API are just leaving out the OAuth state check entirely, since the hasInvalidState checks for that stateless property before checking the OAuth state value. Omitting the state check opens up CSRF attacks on the client, which was the reason for including the state parameter in OAuth in the first place. That said, PKCE prevents CSRF attacks in a cleaner way, by having the server enforce it. (it also prevents some other attacks as well).

The best way to resolve this in a future update would be to provide two ways for people to add PKCE when using it from an API without a session, either:

• make the codeVerifier that the library generates available to the calling code so that it can provide it to the getAccessTokenResponse method
• set the codeVerifier value when they make the method call to get the authURL, and also provide the codeVerifier value to the getAccessTokenResponse method

[driesvints]

@aaronpk think it's best that you just attempt a PR with what you want to do so we can look at actual code.

[binotaliu]

enablePKCE() method is declared as protected. How do I enable it without extending my own provider?

[Lukerayn3r]

@aaronpk Did you ever get chance to work on a PR for using PKCE on a stateless API? I have got it working by manually setting the $codeVerifier value, I now just need to get it working with a random $codeVerifier instead.

Is this possible and if so do you have any suggestions?