Skip to main content
Information Security

Return to Question

replaced https://tools.ietf.org/html/rfc with https://www.rfc-editor.org/rfc/rfc
Source Link
Community Bot
Community Bot
  • 1

A typical OAuth2 Authorization Code Flow scenario looks like this:

Typical flow diagram

What I'm not understanding is the purpose of the client secret in steps 6 and 7. If the auth server is guaranteed to redirect back to the web app and send its authorization code there, how could an attacker get the authorization code (which is presumably the reason for the client secret)?

In addition, it seems that the PKCE extension does away with the need for the client secret, but reading the RFCthe RFC for that I can't see any reason why it should. Could somebody explain this for me?

A typical OAuth2 Authorization Code Flow scenario looks like this:

Typical flow diagram

What I'm not understanding is the purpose of the client secret in steps 6 and 7. If the auth server is guaranteed to redirect back to the web app and send its authorization code there, how could an attacker get the authorization code (which is presumably the reason for the client secret)?

In addition, it seems that the PKCE extension does away with the need for the client secret, but reading the RFC for that I can't see any reason why it should. Could somebody explain this for me?

A typical OAuth2 Authorization Code Flow scenario looks like this:

Typical flow diagram

What I'm not understanding is the purpose of the client secret in steps 6 and 7. If the auth server is guaranteed to redirect back to the web app and send its authorization code there, how could an attacker get the authorization code (which is presumably the reason for the client secret)?

In addition, it seems that the PKCE extension does away with the need for the client secret, but reading the RFC for that I can't see any reason why it should. Could somebody explain this for me?

Source Link
Jez
Jez
  • 346
  • 2
  • 13

What is the purpose of the OAuth2 client secret?

A typical OAuth2 Authorization Code Flow scenario looks like this:

Typical flow diagram

What I'm not understanding is the purpose of the client secret in steps 6 and 7. If the auth server is guaranteed to redirect back to the web app and send its authorization code there, how could an attacker get the authorization code (which is presumably the reason for the client secret)?

In addition, it seems that the PKCE extension does away with the need for the client secret, but reading the RFC for that I can't see any reason why it should. Could somebody explain this for me?