How deeply does ASP.NET Core in Action, 3e cover Proof Key for Code Exchange?

Defines PKCE’s protective role and contrasts grant choices, but does not detail proof-key generation or exchange mechanics.

Proof Key for Code Exchange

As explained in ASP.NET Core in Action, 3e

Authorization code with PKCE is an OAuth authorization flow that protects the authorization code exchange with a proof key generated by the client.

Proof Key for Code Exchange (PKCE) extends the OAuth 2.0 authorization code flow. The client generates a proof key that protects the exchange of an authorization code for a token, adding protection against certain attacks. section 25.1.3

Use PKCE to distinguish common OAuth 2.0 scenarios:

Favor authorization code with PKCE when a user initiates an interactive authorization flow. section 25.1.3 section 25.7
Use client credentials instead when one API calls another without a user. section 25.1.3 section 25.7
Treat PKCE as authorization protection, not as authentication; OpenID Connect adds authentication to OAuth 2.0. section 25.1.3

Interactive photo access

A user authorizes dogphotos.com to access photos through Facebook. The application uses the authorization code with PKCE flow to obtain a token, while the proof key adds protection to the code exchange. section 25.1.3

How ASP.NET Core in Action, 3e covers it

liveBook manning.com

Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Software Security for DevelopersProof Key for Code Exchange is an OAuth extension in which a client proves possession of a per-request secret when exchanging an authorization code.
liveBook manning.com

Secure APIsProof Key for Code Exchange (PKCE) is an OAuth security extension in which a client binds an authorization-code request to a proof derived from a secret.
liveBook manning.com

Spring Security in Action, Second EditionProof key for code exchange is an OAuth extension that binds an authorization-code exchange to a client-generated secret to mitigate code interception.
liveBook manning.com

Building Distributed Applications that WorkProof Key for Code Exchange is an OAuth security extension that binds an authorization-code exchange to the client that initiated it.

Compare how 5 books explain Proof Key for Code Exchange →

Related concepts

authorization code flowuses · The authorization code flow is an OAuth protocol in which a client obtains a short-lived authorization code after user authorization and exchanges it for access or other tokens.
OAuthuses · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
public clientaddresses · A public client is an OAuth client that cannot securely keep its credentials confidential, such as an application distributed to users or running in a browser.
cross-site request forgeryaddresses · Cross-site request forgery is a web attack that induces an authenticated user’s browser to submit an unintended request to a trusted application.

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.