PKCE
Proof Key for Code Exchange (RFC 7636). A binding between an authorization request and the code exchange that prevents intercepted authorization codes from being redeemed. Originally for mobile and SPA clients; OAuth 2.1 requires PKCE for all clients.
PKCE started as a mobile fix for codes intercepted through custom URL schemes and is now recommended for every client including confidential ones, which is why OAuth 2.1 makes it mandatory. The mechanism is simple: the client commits to a secret verifier at request time and must produce it at exchange time, so a stolen code alone is worthless. There is no reason to omit it in new code.
See also: authorization code flow, OAuth 2.1, OIDC authorization code with PKCE recipe, OAuth 2.0
Related on Start with Identity
- GlossaryDevice Authorization Grant
An OAuth 2.0 flow (RFC 8628) for input-constrained devices like TVs and CLIs. The user authorizes on a second device using a short code. Device code flow is the
- GlossaryPAR
Pushed Authorization Requests (RFC 9126). The client sends authorization parameters directly to the server over a back channel first, hardening the flow against
- GlossaryClient Credentials Grant
An OAuth 2.0 flow where an application authenticates as itself, with no user present, to obtain an access token. The standard pattern for machine-to-machine acc
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- CVEOAuth 2.0 private_key_jwt audience ambiguity
A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted b