There is a SPA that uses Authorization Code Grant flow with PKCE to get info from an API all the info is highly sensitive


Here is what I found of how Authorization Code Grant flow with PKCE works:


v = code_verifier

$ = code_challenge

a = authorization_code

enter image description here


In this article https://www.scottbrady91.com/oauth/client-authentication-vs-pkce said that PKCE is not enough and you need client authentication still

PKCE helps protect you against various code injection attacks, but PKCE does not replace client authentication.

and the purpose of PKCE is to ensure that all the requests come from the same client

With PKCE, you prove that the same application is swapping the code as the one who requested it.


PKCE is just to ensure that all the requests come from the same client, but it doesn't care if the client is authorized or not


  • The SPA can't use the backend, so all requests are exposed all the time

  • I can't rely on SOP or CORS to block, you know that some clients like postman can overpass SOP and CORS

  • The info is very sensitive, so only authorized clients can get the info, for example: https://authorized-third-party.com must be able to get his info, but http://fake-third-party.com must not be able to get the info


  • What will happen if someone authenticates using the SPA and get code_verifier (random string), code_challenge (hashed code verifier using SHA-256) and authorization code (or simply the token generated at the end of the grant flow) from the request by opening the web developer tools, Is he able to request the information in its own client using verifier, challenge and auth code to get the information?

  • What is the real purpose of Authorization Code Grant flow with PKCE?

  • Should include any additional grant flow? If so, which and how can I combine both?

  • if PKCE purpose is not caring if the client is authorized or not, How can avoid unauthorized clients to get the info?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.