oauth.net
Proof Key for Code Exchange (PKCE)
PKCE prevents authorization code injection and CSRF attacks in the Authorization Code flow. It is recommended for all OAuth clients â not just public clients.
PKCE works by having the client generate a random secret called a code verifier, then derive a code challenge from it. The code challenge is sent with the authorization request, and the original verifier is sent when exchanging the code for a token. This ensures only the client that started the flow can complete it.
PKCE is not a form of client authentication and does not replace a client secret. Use it alongside whatever client authentication method you're already using â it adds a separate layer of protection against code injection.
When to use this
Use PKCE on every Authorization Code flow. It was originally designed for mobile and native apps (which can't safely store a client secret), but its protection against authorization code injection makes it valuable for all client types, including confidential web apps.
Videos
- What's New With OAuth and OIDC? (8:22)
- What's the Difference between Confidential and Public Clients?
- What's Going On with the Implicit Flow?
Tools
- PKCE on the OAuth 2.0 Playground (oauth.com)
- PKCE Code Challenge Generator (example-app.com)
More resources
- PKCE (oauth.com)
- Mobile Apps (aaronparecki.com)
- OAuth 2.0 for Mobile & Desktop Apps (developers.google.com)
- OAuth 2.0 for Native and Mobile Apps (developer.okta.com)
