Glossary
PROOF KEY FOR CODE EXCHANGE / PKCE
defined.
An OAuth 2.0 extension that prevents authorization code interception attacks, mandatory for public clients (mobile apps, SPAs).
A–Z
An OAuth 2.0 extension that prevents authorization code interception attacks, mandatory for public clients (mobile apps, SPAs).
PKCE works by having the client send a high-entropy code_verifier hashed into a code_challenge at authorization time, then proving possession of the verifier when exchanging the code for tokens. RFC 9700 (OAuth 2.1 best practice) mandates PKCE for all clients, public and confidential.
See our web application penetration testing, API security testing, network penetration testing, and cloud security audit services for how we test for and defend against this class of issue.
30-minute call with an OSCP-certified engineer. Tailored proposal in 24 hours.