The authorization code grant flow with PKCE

PKCE is a more secure variation of the authorization code grant flow that was mainly introduced for SPAs. It was introduced to mitigate the authorization code interception attack, which aims to steal the authorization code from a legitimate application in order to obtain an access token.

Let’s see how this flow works:

Figure 4.3 – PKCE

The flow is explained in detail as follows:

1. The client application requests an authorization code (authorization grant proof) from the /authorize endpoint of the authorization (AuthZ) server. Before sending the request, the client application generates a secret named code_verifier; it transforms it with a transformation named t_m and attaches the following to the authorization request:
   • t(code_verifier): The transformed secret
   • t_m: The transformation function
2. The authorization server stores the transformed secret, t(code_verifier), and the transformation function...