Authorization code + PKCE
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
follow the flow used by web, mobile, and single-page apps.
Planned topics
- The client sends the user's browser to the authorization server to log in and approve.
- The server returns a short-lived authorization code to the client's redirect URL.
- The client swaps the code for tokens at the token endpoint.
- PKCE: the client invents a secret (
code_verifier), sends its hash (code_challenge) first, then proves it with the verifier. A stolen code is then useless. - Use this flow whenever a user logs in; current guidance recommends PKCE for all clients. The implicit grant and the password grant are not for new systems.
Draft outline details
Demonstration
a sequence diagram of the steps above with code_challenge and code_verifier marked.
Check your understanding
What problem does PKCE solve?
Show answer
A stolen authorization code cannot be exchanged without the verifier.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.