codeChallengeMethod
Code challenge method used for PKCE (RFC 7636) during the authorization code flow.
Only CodeChallengeMethod.S256 is supported.
When enabled, a per-request code verifier is generated and stored in the encrypted state cookie. The authorization request adds the code_challenge (the Base64URL-encoded, unpadded SHA-256 digest of the verifier) and code_challenge_method (S256) parameters, and the token exchange request adds the matching code_verifier parameter so the provider can verify the challenge.
Set to null to disable PKCE. Use this only with legacy OpenID Providers that reject PKCE parameters.