Skip to main content
Information Security

Return to Question

Bumped by Community user
Bumped by Community user
Bumped by Community user
Bumped by Community user
deleted 5 characters in body
Source Link
Peter Carter
Peter Carter
  • 189
  • 10

I've implemented Auth Code flow with PKCE on my server, but I'm still not entirely clear on why I'm doing it. I've read through the IETF documentation and I get flashes of what seems like understanding but it always seems to fade.

The nearest I can tell at the moment is that an attacker could have access to server info (via leaking HTTP logs it seems they are saying) but not client info, and thus when you add the code verifier and code challenge you're cutting that out. But then, if you're not acting as a third-party provider atm (and the new guidance seems to include people who aren't) what's the authorization code step for and how does that make things better than with Implict Flow?

I'm sure that's ridiculously simplistic. Anything that could help me understand is very welcome :).

I've implemented Auth Code flow with PKCE on my server, but I'm still not entirely clear on why I'm doing it. I've read through the IETF documentation and I get flashes of what seems like understanding but it always seems to fade.

The nearest I can tell at the moment is that an attacker could have access to server info (via leaking HTTP logs it seems they are saying) but not client info, and thus when you add the code verifier and code challenge you're cutting that out. But then, if you're not acting as a third-party provider atm (and the new guidance seems to include people who aren't) what's the authorization code step for and how does that make things better than with Implict Flow?

I'm sure that's ridiculously simplistic. Anything that could help me understand is very welcome :).

I've implemented Auth Code flow with PKCE on my server, but I'm still not entirely clear on why I'm doing it. I've read through the IETF documentation and I get flashes of what seems like understanding but it always seems to fade.

The nearest I can tell at the moment is that an attacker could have access to server info (via leaking HTTP logs it seems they are saying) but not client info, and thus when you add the code verifier and code challenge you're cutting that out. But then, if you're not acting as a third-party provider atm (and the new guidance seems to include people who aren't) what's the authorization code for and how does that make things better than with Implict Flow?

I'm sure that's ridiculously simplistic. Anything that could help me understand is very welcome :).

Source Link
Peter Carter
Peter Carter
  • 189
  • 10

Why does Authorization Code flow need the authorization code?

I've implemented Auth Code flow with PKCE on my server, but I'm still not entirely clear on why I'm doing it. I've read through the IETF documentation and I get flashes of what seems like understanding but it always seems to fade.

The nearest I can tell at the moment is that an attacker could have access to server info (via leaking HTTP logs it seems they are saying) but not client info, and thus when you add the code verifier and code challenge you're cutting that out. But then, if you're not acting as a third-party provider atm (and the new guidance seems to include people who aren't) what's the authorization code step for and how does that make things better than with Implict Flow?

I'm sure that's ridiculously simplistic. Anything that could help me understand is very welcome :).