mod_http_oauth2: Do not enforce PKCE on Device and OOB flows PKCE does not appear to be used with the Device flow. I have found no mention of any interaction between those standards. Since no data is delivered via redirects in these cases, PKCE may not serve any purpose. This is mostly a problem because we reuse the authorization code to implement the Device and OOB flows.

local disable_tls_ports = module:get_option_set("disable_tls_ports", {});

module:hook("stream-features", function (event)
	if disable_tls_ports:contains(event.origin.conn:serverport()) then
		module:log("error", "Disabling TLS for client on port %d", event.origin.conn:serverport());
		event.origin.conn.starttls = false;
	end
end, 1000);