使用AppAuth实现Spotify PKCE授权时提示code_verifier不正确求助

针对你用AppAuth实现Spotify授权时遇到的code_verifier was incorrect错误，结合代码片段整理以下排查和修复方向：

1. 替换手动实现的PKCE挑战生成逻辑 #

你当前手动实现的challenge函数存在潜在疏漏，不如直接使用AppAuth内置的标准PKCE挑战生成方法，该方法完全符合RFC规范，避免手动编码的错误。

替换挑战生成代码为：

let codeVerifier = OIDAuthorizationRequest.generateCodeVerifier()
// 用AppAuth内置方法生成符合标准的S256挑战
let codeChallenge = OIDAuthorizationRequest.codeChallengeS256(forVerifier: codeVerifier!)

2. 移除不必要的Client Secret #

Spotify将原生移动应用归类为公共客户端，PKCE流程本身就是为无客户端密钥的场景设计的。在OIDTokenRequest中传入clientSecret会干扰服务端验证逻辑，需将其设为nil：

let tokenRequest = OIDTokenRequest(
    configuration: self!.config,
    grantType: OIDGrantTypeAuthorizationCode,
    authorizationCode: callbackURL.queryValue(for: "code"),
    redirectURL: Constants.redirectURI,
    clientID: Constants.clientID,
    clientSecret: nil, // 此处改为nil
    scopes: Constants.scope,
    refreshToken: nil,
    codeVerifier: codeVerifier!,
    additionalParameters: nil
)

3. 改用AppAuth自动处理PKCE的完整流程 #

AppAuth支持自动处理PKCE全流程，无需手动生成和传递verifier、challenge参数，这是最稳妥的实现方式：

调整授权请求代码 #

// 创建授权请求时，无需手动添加code_challenge相关参数，AppAuth自动处理
let request = OIDAuthorizationRequest(
    configuration: config,
    clientId: Constants.clientID,
    scopes: Constants.scope,
    redirectURL: Constants.redirectURI,
    responseType: OIDResponseTypeCode,
    additionalParameters: nil
)

let session = ASWebAuthenticationSession(
    url: request.externalUserAgentRequestURL(),
    callbackURLScheme: Constants.redirectURI.scheme
) { [weak self] callbackURL, error in
    guard let self = self else { return }
    if let error = error {
        completion(.failure(error))
        return
    }
    
    guard let callbackURL = callbackURL else {
        let error = NSError(domain: OIDOAuthAuthorizationErrorDomain, code: OIDErrorCodeOAuthToken.rawValue, userInfo: nil)
        completion(.failure(error))
        return
    }

    // 用AppAuth的授权响应对象解析回调URL，自动保留code_verifier
    guard let authResponse = OIDAuthorizationResponse(url: callbackURL, originalRequest: request) else {
        let error = NSError(domain: OIDOAuthAuthorizationErrorDomain, code: OIDErrorCodeInvalidGrant.rawValue, userInfo: [NSLocalizedDescriptionKey: "无效的授权响应"])
        completion(.failure(error))
        return
    }

    // 创建Token请求时，直接使用authResponse中的codeVerifier
    let tokenRequest = OIDTokenRequest(
        configuration: self.config,
        grantType: OIDGrantTypeAuthorizationCode,
        authorizationCode: authResponse.code!,
        redirectURL: Constants.redirectURI,
        clientID: Constants.clientID,
        clientSecret: nil,
        scopes: Constants.scope,
        refreshToken: nil,
        codeVerifier: authResponse.codeVerifier,
        additionalParameters: nil
    )

    // 后续执行token请求逻辑...
}

4. 验证code参数的正确性 #

检查callbackURL.queryValue(for: "code")的实现，确保正确提取授权码。可替换为系统标准的URLComponents解析方式避免自定义方法的bug：

guard let components = URLComponents(url: callbackURL, resolvingAgainstBaseURL: false),
      let code = components.queryItems?.first(where: { $0.name == "code" })?.value else {
    // 处理code提取失败的情况
    return
}

内容的提问来源于stack exchange，提问作者Kenny Nguyen