[Add] csrf 테스트 추가

playground/pkce/src/PKCEDowngradeExpress.js

@@ -0,0 +1,31 @@
+const express = require("express");
+const app = express();
+
+app.get("/auth", (req, res) => {
+  const {
+    client_id,
+    response_type,
+    code_challenge,
+    code_challenge_method,
+    scope
+  } = req.query;
+
+  console.log("Incoming request:", req.query);
+
+  if (!client_id || response_type !== "code") {
+    return res.status(400).send("Missing required parameters");
+  }
+
+  // Simulate issuing an authorization code
+  const code = "dummy-auth-code";
+
+  // Simulate PKCE check (normally you'd validate here)
+  // We deliberately allow the downgrade here to simulate the vulnerability
+  const responseBody = `Authorization successful. code=${code}`;
+  return res.status(200).send(responseBody);
+});
+
+const PORT = 5050;
+app.listen(PORT, () => {
+  console.log(`Test PKCE server running on http://localhost:${PORT}`);
+});