Feature summary (what you would like to be able to do and where):
Add configuration option "codeChallengeMethod" for PKCE support. Can be set to "S256".
Use case(s) (list the steps that you performed to discover that problem, and describe the actual underlying problem which you want to solve. Do not describe only a solution):
Many OIDC providers support the PKCE flow (Proof Key for Code Exchange) https://oauth.net/2/pkce/ which increases security in OIDC authentication flows. Some even mandate it.
The OpenID Connect extension should support PKCE.
Benefits (why should this be implemented?):
Increased security for OIDC authentication
Support OIDC providers with mandatory PKCE
A patch has already been submitted in Gerrit: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/OpenIDConnect/+/1035869