I don't understand why you would use PKCE for an oauth when you could alternately store a key and have it be returned in the state.

[mcc@mastodon.social]

I don't understand why you would use PKCE for an oauth when you could alternately store a key and have it be returned in the state. Is this like jwt and the idea is it's doing some weird crypto so you can fire off oauth from one server and have the request returned to something else in your load balancer and your own servers don't have to coordinate?

[mcc@mastodon.social]

Also really unsure how i'm gonna *test* this oauth code without deploying the whole damn thing to a server. I wonder if I try to register with Mastodon an app that claims its address is "127.0.0.1:5008" if Mastodon will tolerate that

[mcc@mastodon.social]

UPDATE: Mastodon has absolutely no problem with doing an oauth redirect to 127.0.0.1

[mcc@mastodon.social]

UPDATE 2: Hey so guess what I just learned. Guess what happens when you ask a web browser to set a cookie on 127.0.0.1.