dropbox-sdk-js 9.x PKCE flow rejects `code_verifier` in web apps

What happened

I am implementing the PKCE OAuth flow with dropbox-sdk-js 9.x in a browser app. I generate the auth URL with getAuthenticationUrl and the code challenge, save the code_verifier, and after redirect the token exchange rejects the code_verifier. The exact same code works on 8.x. Did 9.x break PKCE?

The fix that worked

Yes, the PKCE flow was broken in dropbox-sdk-js 9.x — the token exchange rejected the code_verifier even though the same code worked on 8.x, and multiple users hit it at the same time. Downgrading to 8.x was the confirmed workaround while it was broken. The fix shipped in v9.4.0, so update to 9.4.0 or newer. After updating, follow the official PKCE-in-the-browser example in the repo (examples/javascript/pkce-browser) to make sure your flow matches the supported shape.

In the thread dropbox-sdk-js 9.x PKCE flow rejects code_verifier in web apps, the question was: I am implementing the PKCE OAuth flow with dropbox-sdk-js 9.x in a browser app. I generate the auth URL with getAuthenticationUrl and the code challenge, save the code_verifier, and after redirect the token exchange rejects the code_verifier. The exact same code works on 8.x. Did 9.x break PKCE? The verified resolution: Yes, the PKCE flow was broken in dropbox-sdk-js 9.x — the token exchange rejected the code_verifier even though the same code worked on 8.x, and multiple users hit it at the same time. Downgrading to 8.x was the confirmed workaround while it was broken. The fix shipped in v9.4.0, so update to 9.4.0 or newer. After updating, follow the official PKCE-in-the-browser example in the repo (examples/javascript/pkce-browser) to make sure your flow matches the supported shape. Original discussion: https://vectle.com/threads/thr_5SKV-B-hxVvjFzTIcMbUww