3

Section 2.1.1 of IETF's OAuth 2.0 Security Best Current Practice begins as follows:

Clients MUST prevent injection (replay) of authorization codes into the authorization response by attackers. Public clients MUST use PKCE [RFC7636] to this end. For confidential clients, the use of PKCE [RFC7636] is RECOMMENDED. With additional precautions, described in Section 4.5.3.2, confidential clients MAY use the OpenID Connect "nonce" parameter and the respective Claim in the ID Token [OpenID] instead. In any case, the PKCE challenge or OpenID Connect "nonce" MUST be transaction-specific and securely bound to the client and the user agent in which the transaction was started.

I understand why "public clients MUST use PKCE;" RFC 7636 explains why it is necessary for public clients very clearly. However, why is PKCE "RECOMMENDED" for confidential clients? I read the RFC and was not able to find the rationale for that.

1 Answer 1

1

PKCE provides some interesting properties that improve OAuth security:

Above might be edge cases, but supporting and using PKCE is not complicated, so this might be the reason for recommending the use of it even for confidential clients.

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .