How deeply does Spring Security in Action, Second Edition cover Proof Key for Code Exchange?

Explains verifier generation, challenge hashing, request placement, and authorization-server comparison without framework implementation details.

Proof Key for Code Exchange

As explained in Spring Security in Action, Second Edition

Proof key for code exchange is an OAuth extension that binds an authorization-code exchange to a client-generated secret to mitigate code interception.

Proof Key for Code Exchange (PKCE, pronounced “pixy”) strengthens the OAuth authorization code flow when an attacker might steal client credentials or an authorization code. It binds the token request to the same client that initiated user authentication. section 13.3.2

Apply PKCE across two authorization-code steps:

Generate a random value called the verifier. section 13.3.2
Hash the verifier to produce the challenge, then send the challenge with the user-login request. section 13.3.2
Send the verifier when requesting the access token; the authorization server compares it with the stored challenge. section 13.3.2
Reject the exchange when the verifier does not match, preventing a stolen authorization code alone from producing an access token. section 13.3.2

verifier = random();
challenge = hash(verifier);

A compact pseudocode listing captures the essential relationship: the client sends the hash-derived challenge first and the verifier later. section 13.3.2

How Spring Security in Action, Second Edition covers it

Cover of Spring Security in Action, Second Edition

liveBook manning.com

Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Software Security for DevelopersProof Key for Code Exchange is an OAuth extension in which a client proves possession of a per-request secret when exchanging an authorization code.
liveBook manning.com

ASP.NET Core in Action, 3eAuthorization code with PKCE is an OAuth authorization flow that protects the authorization code exchange with a proof key generated by the client.
liveBook manning.com

Secure APIsProof Key for Code Exchange (PKCE) is an OAuth security extension in which a client binds an authorization-code request to a proof derived from a secret.
liveBook manning.com

Building Distributed Applications that WorkProof Key for Code Exchange is an OAuth security extension that binds an authorization-code exchange to the client that initiated it.

Compare how 5 books explain Proof Key for Code Exchange →

Related concepts

authorization code flowuses · The authorization code flow is an OAuth protocol in which a client obtains a short-lived authorization code after user authorization and exchanges it for access or other tokens.
OAuthuses · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
public clientaddresses · A public client is an OAuth client that cannot securely keep its credentials confidential, such as an application distributed to users or running in a browser.
cross-site request forgeryaddresses · Cross-site request forgery is a web attack that induces an authenticated user’s browser to submit an unintended request to a trusted application.

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.