INCRM
Angular
General
Commonly used apps
Extras
Additional pages and features
Documentation
Resources for developers
Your trial is expiring soon!
You have 3 days left in your trial. Upgrade to pro to continue using all features.
Check out BuilderKit; the next generation of toolkit for building beautiful Angular applications. Use promo code FUSE on checkout for 20% off your purchase!
AI Chat
Today
Yesterday
Previous 7 days
Explaining OAuth PKCE to the team
I need a plain-English explanation of PKCE for a team that knows OAuth but not the details.
The problem PKCE solves is narrow: in a public client there is no secret, so if an attacker intercepts the authorization code, nothing stops them from redeeming it. PKCE gives the client a way to prove it is the same party that started the flow.
The client invents a random string, keeps it, and sends only its hash when it asks for the code. When it later exchanges the code it sends the original string. The server hashes it and compares. An attacker holding the code alone cannot produce the string, so the exchange fails.
The useful framing for the team is that it turns a bearer secret into a proof of possession, without ever needing to ship a secret to the browser.
Do we still need it if we use the state parameter?
Yes, they defend against different attacks. state protects against cross-site request forgery on the redirect, meaning someone tricking your app into completing a flow it did not start. PKCE protects the code itself once it has been issued.
Use both. The current guidance treats PKCE as mandatory for every client type, including confidential ones, because it costs almost nothing and closes a class of proxy and redirect leaks.
AI can make mistakes. Check important info.