Page Comparison

Guide for Projector Citizen Integrators

using System;
using System.Text;
using System.Security.Cryptography;
using System.Linq;
					
public class Program
{
	public static void Main()
	{
		foreach(string codeChallengeMethod in new [] { "plain", "S256" })
		{
			string codeVerifier = PkceGenerateCodeVerifier();
			string codeChallenge = PkceGetCodeChallenge(codeVerifier, codeChallengeMethod);
			Console.WriteLine("Client-Derived " + codeChallengeMethod + " Code Challenge sent to server as part of authentication code request is: " + codeChallenge);
			Console.WriteLine("On receipt of authentication code request, server determines that code challenge is " + (PkceCodeChallengeIsValid(codeChallenge, codeChallengeMethod) ? string.Empty : "in") + "valid.");
			
			foreach (string sentCodeVerifier in new [] { codeVerifier, "ILLEGAL-CODE-VERIFIER-SIMULATING-ATTEMPT-TO-CRACK-THE-SYSTEM" })
			{
				Console.WriteLine("On token aquisition request, Client-generated " + codeChallengeMethod + " code verifier sent to server is: " + sentCodeVerifier);
				Console.WriteLine("Based on PKCE vervication, server does " + (PkceVerify(codeChallenge, sentCodeVerifier, codeChallengeMethod) ? string.Empty : "NOT ") + "grant access token to client.");
			}

			Console.WriteLine();
		}
	}
	
	static string PkceGenerateCodeVerifier()
	{
		int len = random.Next(43, 129);  // random.Next() documented to be inclusive of lower bound, but exclusive of upper bound.
 		char[] chars = new char[len];
		for (int i = 0; i < len; i++)
		{
			chars[i] = validChars[random.Next(0, validCharsLength)];  // random.Next() documented to be inclusive of lower bound, but exclusive of upper bound.
		}
		return new string(chars);
	}
	
	private static readonly Random random = new Random();
	private const string validChars = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_.~";
	private static readonly int validCharsLength = validChars.Length;
	
	static string PkceGetCodeChallenge(string codeVerifier, string codeChallengeMethod)
	{
		switch(codeChallengeMethod)
		{
			case "plain":
				return PkceGetPlainCodeChallenge(codeVerifier);
			case "S256":
				return PkceGetS256CodeChallenge(codeVerifier);
			default:
				throw new ArgumentException("Must be \"plain\" or \"S256\"", nameof(codeChallengeMethod));
		}
	}
	
	static bool PkceCodeChallengeIsValid(string codeChallenge, string codeChallengeMethod)
	{
		switch(codeChallengeMethod)
		{
			case "plain":
				return PkceCodeVerifierIsValid(codeChallenge);
			case "S256":
				try
				{
					byte[] codeChallengeBytes = Base64UrlDecode(codeChallenge);
					if (codeChallengeBytes.Length != 32)
					{
						throw new ArgumentException("does not decode to byte array of length 32.", nameof(codeChallenge));
					}
					return true;
				}
				catch(Exception ex)
				{
					Console.WriteLine("Caught invalid S256 Code Challenge of " + codeChallenge);
					Console.WriteLine(ex);
					return false;
				}
			default:
				throw new ArgumentException("Must be \"plain\" or \"S256\"", nameof(codeChallengeMethod));
		}
	}
	
	static bool PkceVerify(string codeChallenge, string codeVerifier, string codeChallengeMethod)
	{
		switch(codeChallengeMethod)
		{
			case "plain":
				return codeChallenge == codeVerifier;
			case "S256":
				return Base64UrlDecode(codeChallenge).SequenceEqual(GetS256Hash(codeVerifier, Encoding.ASCII));
			default:
				throw new ArgumentException("Must be \"plain\" or \"S256\"", nameof(codeChallengeMethod));
		}
	}
	
	static bool PkceCodeVerifierIsValid(string codeVerifier)
	{
		return codeVerifier != null && codeVerifier.Length >= 43 && codeVerifier.Length <= 128 && codeVerifier.All(c => char.IsLetterOrDigit(c) || c == '-' || c == '_' || c == '.' || c == '~');
	}
	
	static string ThrowIfInvalidPkceCodeVerifier(string codeVerifier)
	{
		return PkceCodeVerifierIsValid(codeVerifier) ? codeVerifier : throw new ArgumentException("Must be between 43 and 128 characters in length and entirely made up of letters and digits and periods, hyphens, underscores, and tildes.",nameof(codeVerifier));
	}
	
	static string PkceGetPlainCodeChallenge(string codeVerifier)
	{
		return ThrowIfInvalidPkceCodeVerifier(codeVerifier);
	}
	
	static string PkceGetS256CodeChallenge(string codeVerifier)
	{
		return Base64UrlEncode(GetS256Hash(ThrowIfInvalidPkceCodeVerifier(codeVerifier), Encoding.ASCII));  
	}
	
	static byte[] GetS256Hash(string str, Encoding encoding)
	{
		if (str == null)
		{
			throw new ArgumentNullException(nameof(str));
		}
		if (encoding == null)
		{
			throw new ArgumentNullException(nameof(encoding));
		}
		using (SHA256 sha256 = SHA256.Create())
		{
			return sha256.ComputeHash(encoding.GetBytes(str));
		}
	}
	
	static string Base64UrlEncode(byte[] bytes)
	{
		return Convert.ToBase64String(bytes).TrimEnd(padding).Replace('+', '-').Replace('/', '_');
	}
	
	static byte[] Base64UrlDecode(string str)
	{
		string incoming = str.Replace('_', '/').Replace('-', '+');
		switch(str.Length % 4)
		{
			case 2: incoming += "=="; break;
			case 3: incoming += "="; break;
		}
		return Convert.FromBase64String(incoming);
	}
	
	private static readonly char[] padding = { '=' };
}