Section 2.1.1 of IETF's OAuth 2.0 Security Best Current Practice begins as follows:

Clients MUST prevent injection (replay) of authorization codes into the authorization response by attackers. Public clients MUST use PKCE [RFC7636] to this end. For confidential clients, the use of PKCE [RFC7636] is RECOMMENDED. With additional precautions, described in Section, confidential clients MAY use the OpenID Connect "nonce" parameter and the respective Claim in the ID Token [OpenID] instead. In any case, the PKCE challenge or OpenID Connect "nonce" MUST be transaction-specific and securely bound to the client and the user agent in which the transaction was started.

I understand why "public clients MUST use PKCE;" RFC 7636 explains why it is necessary for public clients very clearly. However, why is PKCE "RECOMMENDED" for confidential clients? I read the RFC and was not able to find the rationale for that.

1 Answer 1


PKCE provides some interesting properties that improve OAuth security:

Above might be edge cases, but supporting and using PKCE is not complicated, so this might be the reason for recommending the use of it even for confidential clients.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .