I've run into this docs when I was studying some SSO concepts;

This grant adds the concept of a code_verifier to the Authorization Code Grant. When the Client asks for an Authorization Code it generates a code_verifier and its transformed value called code_challenge. The code_challenge and a code_challenge_method are sent along with the request. When the Client wants to exchange the Authorization Code for an Access Token, it also sends along the code_verifier. The Authorization Server transforms this and if it matches the originally sent code_challenge, it returns an Access Token.

And here is the flow;

enter image description here

The part that I did not quite get is how the PKCE way is secure as the interceptor still be able to intercept the code_verifier as much as he could intercept the auth code. I believe I'm missing a point but not able to figure out what it is.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.