Proof Key for Code Exchange (PKCE) adds a security layer to the OAuth authorization-code flow. In ASP.NET Core OpenID Connect configuration, `options.UsePkce` enables it; it is especially relevant to public clients. section 8.3
Proof Key for Code Exchange
Proof Key for Code Exchange is an OAuth security extension that binds an authorization-code exchange to the client that initiated it.
How Building Distributed Applications that Work covers it
- How deep it goes
- Defines PKCE as an OpenID Connect option but does not explain the authorization-code exchange mechanics.
- Examples
- Names `options.UsePkce` as the configuration switch without showing a PKCE-specific code example.
- What you can do after
- Configure PKCE by setting `options.UsePkce` in OpenID Connect options, particularly for public-client authorization-code flows.
- How it connects
- Connects authorization-code flow, OpenID Connect authentication, and public clients.
Also explained in
-
Software Security for DevelopersProof Key for Code Exchange is an OAuth extension in which a client proves possession of a per-request secret when exchanging an authorization code.
-
ASP.NET Core in Action, 3eAuthorization code with PKCE is an OAuth authorization flow that protects the authorization code exchange with a proof key generated by the client.
-
Secure APIsProof Key for Code Exchange (PKCE) is an OAuth security extension in which a client binds an authorization-code request to a proof derived from a secret.
-
Spring Security in Action, Second EditionProof key for code exchange is an OAuth extension that binds an authorization-code exchange to a client-generated secret to mitigate code interception.
Compare how 5 books explain Proof Key for Code Exchange →
Related concepts
- authorization code flowuses · The authorization code flow is an OAuth protocol in which a client obtains a short-lived authorization code after user authorization and exchanges it for access or other tokens.
- OAuthuses · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
- public clientaddresses · A public client is an OAuth client that cannot securely keep its credentials confidential, such as an application distributed to users or running in a browser.
- cross-site request forgeryaddresses · Cross-site request forgery is a web attack that induces an authenticated user’s browser to submit an unintended request to a trusted application.
This explainer was generated by Manning's knowledge graph from the text of Building Distributed Applications that Work. The section links point to the parts of the book it draws on.