OAuth 2.0 Authorization Code Flow with PKCE
Subtitle: How a public app proves it started the login
- Section 1 - The handshake, step by step (numbered vertical sequence with arrows between App, Browser, Auth Server, API):
- App makes random secret: code_verifier
- App sends SHA-256 hash: code_challenge
- User logs in, server returns short code
- App redeems code plus code_verifier
- Server rehashes, matches, issues tokens
Section 2 - Why PKCE exists:
Public apps cannot keep a client secret Mobile and SPA code ships to the user A stolen auth code is useless alone Proof of possession replaces the secret RFC 7636, now required for all clients
Section 3 - The two values, side by side:
code_verifier = random 43-128 char string code_challenge = BASE64URL(SHA-256(verifier)) Sent early: challenge only Sent late: verifier only Server links them, never stores a secret
Section 4 - Callout: Attack it stops:
Authorization code interception Malicious app hijacks the redirect URI It grabs the code but has no verifier Token exchange fails, attack dies Common mistake: using method plain, or reusing one verifier for every login. Always S256 and a fresh random verifier per request.