AWS Cognito support for Managed Login using PKCE flow

Yes, Amazon Cognito's Managed Login does support the PKCE (Proof Key for Code Exchange) flow, which is recommended for single-page applications (SPAs) and mobile apps. However, your experience suggests there might be an issue with the implementation or configuration.

In a proper PKCE flow with Managed Login, you should include the code_challenge in the authorization request to the /oauth2/authorize endpoint, as you've done. After successful authentication and receiving the authorization code, you should then include the original code_verifier in your token request to the /oauth2/token endpoint.

The fact that you're able to retrieve tokens without providing the code_verifier in the token request is unexpected behavior for a PKCE flow. This could indicate a potential security risk, as the purpose of PKCE is to prevent the interception and unauthorized use of authorization codes.

Given that the flow works as expected with the classic hosted UI, there are a few possibilities to consider:

1. There might be a configuration issue specific to your Managed Login setup.
2. There could be a bug in the Managed Login implementation of PKCE.
3. Your app client settings might not be correctly configured to enforce PKCE.

To troubleshoot this issue:

1. Double-check your app client settings in the Amazon Cognito console to ensure PKCE is properly enabled.
2. Verify that you're including all necessary parameters in both the authorize and token requests.
3. Try generating a new code verifier and challenge to ensure they're correctly formed.
4. If the issue persists, it would be advisable to contact AWS support, as this behavior is not in line with the expected PKCE flow implementation.

Remember, PKCE is an important security measure for public clients like SPAs and mobile apps, so it's crucial to ensure it's working correctly in your implementation.
Sources
Using PKCE in authorization code grants - Amazon Cognito
The redirect and authorization endpoint - Amazon Cognito
Choose an Amazon Cognito authentication flow for enterprise applications - AWS Prescriptive Guidance