Proof Key for Code Exchange (PKCE), pronounced “pixy,” protects the OAuth authorization code flow by binding an authorization request to a secret proof. The client creates a private code verifier and sends only its derived code challenge during authorization. section 7.4.2
Without PKCE, an attacker who intercepts an authorization code can exchange it for an access token before the legitimate client does, impersonating the user and accessing their data. PKCE helps prevent this authorization-code interception attack by requiring proof of verifier ownership. section 7.4.2 section 7.8
A PKCE exchange follows these essential steps:
- Generate a unique, high-entropy code verifier containing 43 to 128 characters. section 7.4.2
- Hash the verifier with SHA-256 and base64url-encode the result without padding to create the code challenge. section 7.4.2
- Send the code challenge and code_challenge_method=S256 in the authorization request, then provide the verifier when exchanging the authorization code. section 7.4.2
PKCE authorization request
https://auth.example.com/authorize?response_type=code&client_id=s6BhdRkqt3&redirect_uri=https://example.com&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256 section 7.4.2
https://auth.example.com/authorize?response_type=code &client_id=s6BhdRkqt3&redirect_uri=https://example.com &code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM &code_challenge_method=S256
Inspect a complete authorization URL containing the PKCE code challenge and S256 method. section 7.4.2
