title: Correctly compare code_verifier with code_challenge in Java
body: <p>I'm using passport-oauth2 (passportjs.org and <a href="https://github.com/jaredhanson/passport-oauth2/blob/master/lib/strategy.js" rel="nofollow noreferrer">https://github.com/jaredhanson/passport-oauth2/blob/master/lib/strategy.js</a>) for OAuth2+PKCE integration in a nodejs application.</p>
  
  <p>The backend it's authenticating against is written in Java.</p>
  
  <p>The problem is that I can't seem to decode->hash the code_verifier to correctly match the code_challenge that comes from passport-oauth2.</p>
  
  <p>I know that the Base64 encoding that comes from passport has been generated to be URL safe (no padding, no wrapping, replacements for <code>+</code> or <code>/</code>), so I'm using a Url Decoder:</p>
  
  <pre><code>Base64.getUrlDecoder().decode(...)
  </code></pre>
  
  <p>Then I'm using commons <code>DigestUtils</code> to generate a SHA256 of the decoded verifier and comparing it with the challenge. So the whole thing looks something like this:</p>
  
  <pre><code>    java.util.Base64.Decoder decoder = java.util.Base64.getUrlDecoder();
      String codeChallenge = // get the code challenge from my cache
      byte[] decodedCodeChallenge = decoder.decode(codeChallenge);
      byte[] decodedCodeVerifier = decoder.decode(codeVerifier);
      if (!Arrays.equals(sha256(decodedCodeVerifier), decodedCodeChallenge)) {
          return Response.status(400).entity(ERROR_INVALID_CHALLENGE_VERIFIER).build();
      }
  </code></pre>
  
  <p><strong>Example:</strong></p>
  
  <p>This code verifier: <code>5CFCAiZC0g0OA-jmBmmjTBZiyPCQsnq_2q5k9fD-aAY</code>
  should match this code challenge: <code>Fw7s3XHRVb2m1nT7s646UrYiYLMJ54as0ZIU_injyqw</code> once both have been Base64-url-decoded and the verifier has been SHA256 hashed, but it doesn't.</p>
  
  <p>What am I doing wrong?</p>