Identity Server login asks for code challenge - identityserver4

Question

I have 3 projects
IdentityServer
MVC App
Web Api
That is works fine
MVC App: ConfigureServices
services.AddAuthentication(opt =>
{
opt.DefaultScheme = "Cookies";
opt.DefaultChallengeScheme = "oidc";
})
.AddCookie("Cookies")
.AddOpenIdConnect("oidc", opt =>
{
opt.SignInScheme = "Cookies";
opt.Authority = "https://localhost:5001";
opt.ClientId = "mvc";
opt.ResponseType = "code id_token";
opt.Scope.Add("openid");
opt.Scope.Add("email");
opt.Scope.Add("office");
opt.ClientSecret = "secret";
opt.SignInScheme = "Cookies";
opt.SaveTokens = false;
});
And the client
new Client
{
ClientId = "mvc",
ClientName= "MVC Demo",
Description = "MVC Demo",
AllowedGrantTypes = GrantTypes.Implicit,
RedirectUris = { "https://localhost:44344/signin-oidc" },
PostLogoutRedirectUris = { "https://localhost:44344/signout-callback-oidc" },
BackChannelLogoutUri = "https://localhost:44344/signout-oidc",
FrontChannelLogoutUri = "https://localhost:44344/signout-oidc",
AllowedScopes = { "openid", "email", "office", "profile" },
}
Logging into to the client works absolutely fine, but the issue arises when I want to add a hybrid flow (following the Microsoft academy video from 2019 on it) and it simply isn't working. It's giving me the error code challenge required when logging in - I'm trying to update it so that it can call the API from the MVC app
This is what I update:
I add the scope to the "oidc" scheme, and set the client secret
opt.Scope.Add("api1");
opt.ClientSecret = "secret";
And against the client I add the client secret, add api1 to the allowed scopes, and update the flow to hybrid
ClientSecrets = { new Secret("secret".Sha256()) },
AllowedScopes = { "openid", "email", "office", "profile", "api1" },
AllowedGrantTypes = GrantTypes.Hybrid,
From then, when I click login I get this
I've spent the last 2 days trying to figure out what I'm missing from this

Answer 1

The problem is that IdentityServer expects that you use the PKCE extension and to disable it you can set the RequirePkce parameter to false. However, for security reasons you should try to use this feature.
It says here:
RequirePkce
Specifies whether clients using an authorization code based grant type must send a proof key (defaults to true).
Also, it's recommended not to use the Hybrid flow. Do read this article for more details.
In the source code here, it says:
/// <summary>
/// Enables or disables the use of the Proof Key for Code Exchange (PKCE) standard.
/// This only applies when the <see cref="ResponseType"/> is set to <see cref="OpenIdConnectResponseType.Code"/>.
/// See https://tools.ietf.org/html/rfc7636.
/// The default value is `true`.
/// </summary>
public bool UsePkce { get; set; } = true;
So, its disabled for hybrid flow?