Fixed ordering so we only hash after base64 encoding

2025-05-31 14:12:07 +05:30 · 2017-12-23 02:06:18 +00:00
parent f11e4c81cd
commit 1c36b70dab
2 changed files with 2 additions and 2 deletions
--- a/src/Grant/AuthCodeGrant.php
+++ b/src/Grant/AuthCodeGrant.php
@@ -144,7 +144,7 @@ class AuthCodeGrant extends AbstractAuthorizeGrant
                case 'S256':
                    if (
                        hash_equals(
-                            strtr(rtrim(base64_encode(hash('sha256', $codeVerifier)), '='), '+/', '-_'),
+                            hash('sha256', strtr(rtrim(base64_encode($codeVerifier), '='), '+/', '-_')),
                            $authCodePayload->code_challenge
                        ) === false
                    ) {