web on That Cyborg

OAuth Proof Key for Code Exchange

blog@thatcyb.org (That Cyborg) — Wed, 03 Dec 2025 00:00:00 +0000

PKCE (Proof Key for Code Exchange) is pronounced Pixie and it was introduced in RFC 7636 to make the Authorization Code flow more secure.

This extension prevents CSRF and authorization code injection attacks.

It was first made to protect the authorization code flow in mobile apps since mobile apps are inherently public clients (a user can reverse-engineer the application to find hard-coded secrets).

Basically, if an attacker is able get an authorization client of a victim, it can talk to the token endpoint on the authorization server and get an access token for the user account. For example, if the authorization code is returned to the mobile app via a URI scheme that talks to the app ( read here ), and multiple apps can register as handlers for the same scheme - then the malicious app by the attacker can register as a handler and get the authorization code.

Learning About OAuth

blog@thatcyb.org (That Cyborg) — Sat, 29 Nov 2025 00:00:00 +0000

I recently started learning more about OAuth, this note will document things I learn and find noteworthy.

What is OAuth?

OAuth is an abbreviation for “Open Authorization”. OAuth is an authorization protocol that allows users to give certain permissions to third-party apps and services to access their account without giving them their credentials. Even though there is some authentication protocol built on top of OAuth with OIDC (OpenID Connect), OAuth itself is simply an authorization protocol - which means the protocol doesn’t handle authentication of the user to the authorization server.

Upgrading Your Tools

blog@thatcyb.org (That Cyborg) — Wed, 26 Nov 2025 00:00:00 +0000

I really like learning about new tools that might do somethings differently, and sometimes they might even make your workflow easier.

As an example, I used to always host my websites with either Nginx or Apache but recently I read about Caddy and the installation was super simple.

It basically just works and gets the HTTPS certificates for me instead of using Let’s Encrypt manually with certbot.

Web Content Preserving

blog@thatcyb.org (That Cyborg) — Tue, 28 Nov 2023 00:00:00 +0000

Today I read an interesting article by Jeff Huang on making websites that are supposed to last for many years.

This article lead me to think more about the content nowadays and what I like about the indie web.

I like the idea of writing minimal websites that Just Work (TM) and will work for years to come without constant maintenance.

Also, this lead me to a nice program called ArchiveBox that helps with archiving internet content and viewing it offline.