Medium ThreatAuthentication & TokensCWE-287
OAuth 2.1 Authorization Code Flow with PKCE
Implement secure OAuth 2.1 Authorization Code flow with PKCE for single-page and mobile applications to prevent interception.
Vulnerability Overview
Authorization codes can be intercepted without PKCE.
Malicious apps register the same custom URI scheme to steal codes.
Vulnerable Code
authorize({ response_type: 'code' })No PKCE challenges.
Remediated Code
authorize({ response_type: 'code', code_challenge, code_challenge_method: 'S256' })Uses PKCE.
Hardening Rules
- 1Require PKCE
- 2Use state parameter
- 3Validate redirect URIs exactly
Frequently Asked Questions
Is Implicit Flow safe?
No, OAuth 2.1 deprecates implicit flow in favor of PKCE.