OAuth Proof Key for Code Exchange

blog@thatcyb.org (That Cyborg) — Wed, 03 Dec 2025 00:00:00 +0000

PKCE (Proof Key for Code Exchange) is pronounced Pixie and it was introduced in RFC 7636 to make the Authorization Code flow more secure.

This extension prevents CSRF and authorization code injection attacks.

It was first made to protect the authorization code flow in mobile apps since mobile apps are inherently public clients (a user can reverse-engineer the application to find hard-coded secrets).

Basically, if an attacker is able get an authorization client of a victim, it can talk to the token endpoint on the authorization server and get an access token for the user account. For example, if the authorization code is returned to the mobile app via a URI scheme that talks to the app ( read here ), and multiple apps can register as handlers for the same scheme - then the malicious app by the attacker can register as a handler and get the authorization code.

Learning About OAuth

blog@thatcyb.org (That Cyborg) — Sat, 29 Nov 2025 00:00:00 +0000

I recently started learning more about OAuth, this note will document things I learn and find noteworthy.

What is OAuth?

OAuth is an abbreviation for “Open Authorization”. OAuth is an authorization protocol that allows users to give certain permissions to third-party apps and services to access their account without giving them their credentials. Even though there is some authentication protocol built on top of OAuth with OIDC (OpenID Connect), OAuth itself is simply an authorization protocol - which means the protocol doesn’t handle authentication of the user to the authorization server.

oauth on That Cyborg

OAuth Proof Key for Code Exchange

Learning About OAuth

What is OAuth?