1

If I'm understanding OAuth2 PKCE right, it is to be used in cases where a client cannot be trusted to hold onto a client secret. I also understand (reading RFC 6749) that a client id is not a secret.

This means that a PKCE authorization token request process starts from an unauthenticated computer and an unauthenticated client. So why is client_id a mandatory field? It could easily be forged and thus no authorization can be done using it.

Improve this question

1 Answer 1

Reset to default
0

client_id is used to look up things such as:

  • pre-authorized redirect URLs for that client
  • scopes that the client is allowed to request.

Even if the above weren't needed, another practical consideration is that PKCE is an addition to the OAuth2 specification, and all the OAuth2 flows require client_id. It would be weird to omit client_id just because you've turned on PKCE.

Improve this answer
2
  • Ahh, those make sense. So does this mean that if someone makes a public client and that client requests some resources, a 3rd party could make the exact same request and get their own access token if they could convince the Resource Owner to give them an authentication code of their own?
    – Cort Ammon
    Commented Apr 27 at 22:00
  • Right, the main protection in that case is the authorization server enforcing that the authorization code is only sent to the pre-configured list of redirect URLs.
    – Steve P
    Commented Apr 28 at 18:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .