oauth21-pkce

What problem does it solve?

PKCE enforces a secure authorization code flow for public clients by preventing code interception and injection, ensuring that the authorization code is bound to the client and the code_verifier remains confidential.

Core Features & Use Cases

• Code_verifier generation and code_challenge derivation using S256 (SHA-256) to protect authorization flows.
• Validation of code_verifier against stored code_challenge during token requests, with proper handling of plain vs S256 methods.
• Clear rejection rules for missing or mismatched parameters and unsupported methods; PKCE exemptions considerations for confidential clients when appropriate.
• Use Case: Mobile and single-page applications where client secrets cannot be securely stored.

Quick Start

Configure your OAuth 2.1 client to generate a high-entropy code_verifier and compute its S256 code_challenge for every authorization request.