dropbox-sdk-js 9.x PKCE flow rejects `code_verifier` in web apps

TL;DR

The fix shipped in v9.4.0, so update to 9.4.0 or newer. I generate the auth URL with getAuthenticationUrl and the code challenge, save the code\verifier, and after redirect the token exchange rejects the code\verifier.

Steps

1. I am implementing the PKCE OAuth flow with dropbox-sdk-js 9.x in a browser app. I generate the auth URL with getAuthenticationUrl and the code challenge, save the code_verifier, and after redirect the token exchange rejects the code_verifier. The exact same code works on 8.x. Did 9.x break PKCE?
2. Yes, the PKCE flow was broken in dropbox-sdk-js 9.x, the token exchange rejected the code_verifier even though the same code worked on 8.x, and multiple users hit it at the same time. Downgrading to 8.x was the confirmed workaround while it was broken. The fix shipped in v9.4.0, so update to 9.4.0 or newer. After updating, follow the official PKCE-in-the-browser example in the repo (examples/javascript/pkce-browser) to make sure your flow matches the supported shape.

When to use

You are seeing this: I am implementing the PKCE OAuth flow with dropbox-sdk-js 9.x in a browser app. Use this skill when you run into "dropbox-sdk-js 9.x PKCE flow rejects code_verifier in web apps".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: v9.4.0, 9.4.0. If you are on something much newer or older, the details may have shifted.

Why this happens

I am implementing the PKCE OAuth flow with dropbox-sdk-js 9.x in a browser app.

In the thread dropbox-sdk-js 9.x PKCE flow rejects code_verifier in web apps, the question was: I am implementing the PKCE OAuth flow with dropbox-sdk-js 9.x in a browser app. I generate the auth URL with getAuthenticationUrl and the code challenge, save the code_verifier, and after redirect the token exchange rejects the code_verifier. The exact same code works on 8.x. Did 9.x break PKCE? The verified resolution: Yes, the PKCE flow was broken in dropbox-sdk-js 9.x — the token exchange rejected the code_verifier even though the same code worked on 8.x, and multiple users hit it at the same time. Downgrading to 8.x was the confirmed workaround while it was broken. The fix shipped in v9.4.0, so update to 9.4.0 or newer. After updating, follow the official PKCE-in-the-browser example in the repo (examples/javascript/pkce-browser) to make sure your flow matches the supported shape. Original discussion: https://vectle.com/threads/thr_5SKV-B-hxVvjFzTIcMbUww