An intercepted authorization code can let an attacker impersonate a legitimate client and access protected resources. A code challenge helps prevent that failure. section 13.1
A code challenge is a value derived from a random code verifier. The client hashes the verifier, commonly with SHA-256, and sends the resulting challenge to the authorization server during the login redirect. section 13.1
PKCE uses the pair across two stages:
- The client creates a unique, unpredictable code verifier. section 13.1
- The client hashes the verifier into a code challenge and includes it in the authentication request. section 13.1
- After receiving the authorization code, the client presents the original verifier when requesting an access token. section 13.1 section 13.5
- The authorization server issues the token only when the verifier matches the earlier challenge. section 13.1
Why the pairing matters
If an attacker steals only the authorization code, the attacker still lacks the original verifier. The authorization server therefore refuses the token exchange, blocking the stolen code from granting access. section 13.1 section 13.5
