title: I am getting "code challenge required" when using IdentityServer4
body: <p>I am trying to redirect to IdentityServer for authorization, and getting "code challenge required" in redirect URL.</p>
  
  <p>An error message shows <strong>invalid_request</strong> with code challenge required, and also my redirect url <a href="http://localhost:44367/signin-oidc#error=invalid_request&amp;error_description=code%20challenge%20required&amp;state=CfDJ8Cq6lLUEMhZLqMhFVN" rel="noreferrer">http://localhost:44367/signin-oidc#error=invalid_request&amp;error_description=code%20challenge%20required&amp;state=CfDJ8Cq6lLUEMhZLqMhFVN</a></p>
  
  <p>Here is my client configuration:</p>
  
  <pre class="lang-cs prettyprint-override"><code>namespace TestClient
  {
      public class Startup
      {
          public Startup(IConfiguration configuration)
          {
              Configuration = configuration;
          }
  
          public IConfiguration Configuration { get; }
  
          // This method gets called by the runtime. Use this method to add services to the container.
          public void ConfigureServices(IServiceCollection services)
          {
              services.Configure&lt;CookiePolicyOptions&gt;(options =&gt;
              {
                  // This lambda determines whether user consent for non-essential cookies is needed for a given request.
                  options.CheckConsentNeeded = context =&gt; true;
                  options.MinimumSameSitePolicy = SameSiteMode.None;
              });
  
              services.AddControllersWithViews();
  
              ConfigureIdentityServer(services);
              services.AddCors();
          }
  
          private void ConfigureIdentityServer(IServiceCollection services)
          {
              var builder = services.AddAuthentication(options =&gt; SetAuthenticationOptions(options));
              services.AddMvcCore()
                  .AddAuthorization();
  
              services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_3_0);
  
              builder.AddCookie();
              builder.AddOpenIdConnect(options =&gt; SetOpenIdConnectOptions(options));
          }
  
          private void SetAuthenticationOptions(AuthenticationOptions options)
          {
              options.DefaultScheme = Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationDefaults.AuthenticationScheme;
              options.DefaultChallengeScheme = Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectDefaults.AuthenticationScheme;
          }
  
          private void SetOpenIdConnectOptions(OpenIdConnectOptions options)
          {
              options.Authority = "https://localhost:44346";
              options.ClientId = "TestIdentityServer";
              options.RequireHttpsMetadata = false;
              options.Scope.Add("profile");
              options.Scope.Add("openid");
              options.Scope.Add("TestIdentityServer");
              options.ResponseType = "code id_token";
              options.SaveTokens = true;
              options.ClientSecret = "0b4168e4-2832-48ea-8fc8-7e4686b3620b";
          }
  
  
          // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
          public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
          {
              if (env.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
              }
              else
              {
                  app.UseExceptionHandler("/Home/Error");
                  // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
  
              }
              app.UseHsts();
              app.UseHttpsRedirection();
              app.UseStaticFiles();
  
              app.UseCors(builder =&gt; builder
                  .AllowAnyOrigin()
                  .AllowAnyHeader()
                  .AllowAnyMethod()
              );
  
              app.UseCookiePolicy();
              app.UseRouting();
  
              app.UseAuthentication();
  
              app.UseAuthorization();
  
              app.UseEndpoints(endpoints =&gt;
              {
                  endpoints.MapControllerRoute(
                      name: "default",
                      pattern: "{controller=Home}/{action=Index}/{id?}");
              });
          }
      }
  }
  </code></pre>
  
  <p>And here is my IdentityService4 configuration</p>
  
  <pre class="lang-cs prettyprint-override"><code>  public class Startup
      {
          public Startup(IConfiguration configuration)
          {
              Configuration = configuration;
  
          }
  
          public IConfiguration Configuration { get; }
  
          // This method gets called by the runtime. Use this method to add services to the container.
          public void ConfigureServices(IServiceCollection services)
          {
              IdentityModelEventSource.ShowPII = true;
              services.AddDbContext&lt;ApplicationDbContext&gt;(options =&gt;
                  options.UseSqlServer(
                      Configuration.GetConnectionString("DefaultConnection")));
              services.AddDefaultIdentity&lt;IdentityUser&gt;(options =&gt; options.SignIn.RequireConfirmedAccount = true)
                  .AddEntityFrameworkStores&lt;ApplicationDbContext&gt;();
              services.AddControllersWithViews();
              services.AddRazorPages();
  
              services.AddMvc().SetCompatibilityVersion(Microsoft.AspNetCore.Mvc.CompatibilityVersion.Version_3_0);
              services.Configure&lt;IISOptions&gt;(iis =&gt;
              {
                  iis.AuthenticationDisplayName = "Windows";
                  iis.AutomaticAuthentication = false;
              });
  
              var builder = services.AddIdentityServer(options =&gt;
              {
                  options.Events.RaiseErrorEvents = true;
                  options.Events.RaiseInformationEvents = true;
                  options.Events.RaiseFailureEvents = true;
                  options.Events.RaiseSuccessEvents = true;
              });
              // this adds the config data from DB (clients, resources)
  
              builder.AddInMemoryIdentityResources(Configuration.GetSection("IdentityResources"));
              builder.AddInMemoryApiResources(Configuration.GetSection("ApiResources"));
              builder.AddInMemoryClients(Configuration.GetSection("clients"));
  
              services.AddAuthentication();
          }
  
          // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
          public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
          {
              if (env.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
                  app.UseDatabaseErrorPage();
              }
              else
              {
                  app.UseExceptionHandler("/Home/Error");
                  // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
  
              }
              app.UseHsts();
              app.UseHttpsRedirection();
              app.UseStaticFiles();
  
              app.UseRouting();
              app.UseIdentityServer();
  
              app.UseEndpoints(endpoints =&gt;
              {
                  endpoints.MapControllerRoute(
                      name: "default",
                      pattern: "{controller=Home}/{action=Index}/{id?}");
                  endpoints.MapRazorPages();
              });
          }
      }
  </code></pre>
  
  <p>and appsettings.json</p>
  
  <pre class="lang-cs prettyprint-override"><code>"IdentityResources": [
      {
        "Name": "openid",
        "DisplayName": "Your user identifier",
        "Required": true,
        "UserClaims": [
          "sub"
        ]
      },
      {
        "Name": "profile",
        "DisplayName": "User profile",
        "Description": "Your user profile information (first name, last name, etc.)",
        "Emphasize": true,
        "UserClaims": [
          "name",
          "family_name",
          "given_name",
          "middle_name",
          "preferred_username",
          "profile",
          "picture",
          "website",
          "gender",
          "birthdate",
          "zoneinfo",
          "locale",
          "updated_at"
        ]
      }
    ],
  
    "ApiResources": [
      {
        "Name": "TestIdentityServer",
        "DisplayName": "TestIdentityServer API Services",
        "Scopes": [
          {
            "Name": "TestIdentityServer",
            "DisplayName": "TestIdentityServer API Services"
          }
        ]
      }
    ],
  
    "Clients": [
      {
        "ClientId": "TestIdentityServer",
        "ClientName": "TestIdentityServer Credentials Client",
  
        // 511536EF-F270-4058-80CA-1C89C192F69A
        "ClientSecrets": [ { "Value": "entAuCGhsOQWRYBVx26BCgZxeMt/TqeVZzzpNJ9Ub1M=" } ],
        "AllowedGrantTypes": [ "hybrid" ],
        "AllowedScopes": [ "openid", "profile", "TestIdentityServer" ],
        "RedirectUris": [ "http://localhost:44367/signin-oidc" ],
        //"FrontChannelLogoutUris": [ "http://localhost:44367/Home/Privacy" ],
        //"PostLogoutRedirectUris": [ "http://localhost:44367/Home/Privacy" ],
        "redirect_uri": "http://localhost:44367/signin-oidc"
      }
  </code></pre>