Stack Overflow
Stack Overflow

Questions tagged [pkce]

Proof Key for Code Exchange by OAuth Public Clients

PKCE (RFC 7636) is an extension to the Authorization Code flow to prevent several attacks and to be able to securely perform the OAuth exchange from public clients.

It was originally designed to protect mobile apps, but its ability to prevent authorization code injection makes it useful for every OAuth client, even web apps that use a client secret.

According to the latest best practices:

Clients utilizing the authorization grant type MUST use PKCE in order to (with the help of the authorization server) detect and prevent attempts to inject (replay) authorization codes into the authorization response. The PKCE challenges must be transaction-specific and securely bound to the user agent in which the transaction was started and the respective client.

OpenID Connect clients MAY use the nonce parameter of the OpenID Connect authentication request as specified in [OpenID] in conjunction with the corresponding ID Token claim for the same purpose.

Links

  1. PKCE Sequence Diagram
  2. Why PKCE?
  3. OAuth 2.0 Security Best Current Practice
232 questions
0
votes
1 answer

How to make aspnetcore.authentication.openidconnect make use of PKCE?

For communication with a given Endpoint (german DATEV), our code is required to make use of PKCE (https://www.rfc-editor.org/rfc/rfc7636). It's possible to hook into OpenIdConnectEvents.OnRedirectToIdentityProvider and compute and put…
Sascha
  • 2,193
  • 3
  • 24
  • 38
0
votes
0 answers

OAuth Code Authorization grant with PKCE but for app, not user

The OAuth2 spec defines a Client Credential grant for machine-to-machine authorization, where a user isn't involved. Identity is confirmed via a client secret. This isn't appropriate for a native client, such as a mobile application, because stored…
Charles Flatt
  • 51
  • 4
0
votes
2 answers

What OAuth Frameworks are supporting PKCE (RFC 7636)?

I am evaluating use of the authorization code workflow. RFC 7636 uncovered a problem with public clients and suggested a solution. RFC 7636 was published only in September, 2015. Which OAuth2 frameworks have implemented the recommendations of…
Tevya
  • 836
  • 1
  • 10
  • 23
-1
votes
1 answer

/authorize or /login/callback endless loop

We have a react app using auth code with pkce . When user is not assigned to an App they are getting an endless loop to /login/callback and /authorize endpoint with error “User is not assigned to an app” . I don’t understand why I’m getting the loop…
Klejdi
  • 1
  • 1
-1
votes
1 answer

Karate only seems to support the password flow are there any examples of the auth code flow or better still auth code with pkce

The only example for oauth is https://github.com/intuit/karate/blob/master/karate-demo/src/test/java/demo/oauth/oauth2.feature which is for the password flow are their any examples for the auth code flow or better still auth code with pkce?
mcrobbj
  • 7
  • 2
-1
votes
1 answer

Is the authorization code with pkce default on authcode grant type implementation?

We are using oidc-client. The Client setting grant type is authorization code. However, I found out that my authorization code uses PKCE. Because I can use it without client secret and and has code_challenge on the uri. I'm looking onto it on how it…
choopau
  • 2,209
  • 5
  • 21
  • 28
-1
votes
1 answer

choose oauth2 flow spa application

we are building a full-stack application with a SPA client (reactjs) and a nodejs server which publish resource in an API Rest. I need to authenticate users with an identity provider like azuread or keycloack. i want to use the OpenIdConnect…
jeyzorus
  • 85
  • 9
1 2 3
…
15
16