Verifies a code_verifier against the challenge captured when the
authorization code was minted. Malformed input is rejected before hashing so
the endpoint cannot be used as a hashing oracle, and the comparison is
timing-safe.
Parameters
verifier: string
The code_verifier presented at the token endpoint.
challenge: string
The code_challenge bound to the authorization code.
Returns boolean
True when the verifier produces exactly that challenge.
Verifies a
code_verifieragainst the challenge captured when the authorization code was minted. Malformed input is rejected before hashing so the endpoint cannot be used as a hashing oracle, and the comparison is timing-safe.