Skip to main content

Function: verifyClientSecret()

verifyClientSecret(args): boolean

Defined in: oauth.ts:107

Verifies a presented client_secret against a stored SHA-256 hash in constant time.

Returns false for an absent or empty presented secret, so a confidential client can never authenticate by omitting the credential.

Parameters

ParameterTypeDescription
args{ clientSecret: string | undefined; clientSecretHash: string; }-
args.clientSecretstring | undefinedThe secret presented at the token endpoint.
args.clientSecretHashstringThe stored SHA-256 hex hash to compare against.

Returns

boolean