Cannot authenticate to Gitea because a PKCE is required

[wsw70]

I installed Gitea and Woodpecker (both server and agent) via docker on the same network (and host). Both the Gitea and Woodpecker servers are exposed via a Caddy reverse proxy that creates a https://[gitea|woodpecker].example.com Internet-facing address but the traffic is contained within the local network (hairpinning on the router).

The installation was done according to the documentation.

When attempting to login on to Woodpecker (by pressing the "Login" button on the web page available at https://woodpecker.example.com, the page reloads and the following information is provided in the elog:

gitea-1              | 2024/02/06 14:10:36 ...eb/routing/logger.go:102:func1() [I] router: completed GET /login/oauth/authorize?client_id=f6REDACTED5f&redirect_uri=https%3A%2F%2Fwoodpecker.example.com%2Fauthorize&response_type=code&state=woodpecker for 192.168.10.1:0, 303 See Other in 2.1ms @ auth/oauth.go:362(auth.AuthorizeOAuth)
woodpecker-server-1  | {"level":"error","error":"invalid_request PKCE is required for public clients","time":"2024-02-06T13:10:36Z","message":"cannot authenticate user"}

What does the error message mean (specifically the part about a required PKCE)?

[wsw70]

Found it - I forgot to make the application confidential in Gitea config.