2022-05-29 UTC
# 
[dmitshur] I ran into a website with an IndieAuth implementation where I couldn't login with my site because it was sending me a code_challenge of unexpected length (44 bytes instead of 43). The extra character turned out to be a '=' from base64 URL encoding with padding. At first I thought I wasn't sure if maybe I should be allowing both, but looking into it more I realized both sides must agree exactly on whether padding is used or not when