OAuth PKCE (pronounced “pixy”), for which John Bradley (Ping), Naveen Agarwal (Google), and I are credited as co-authors, has been published as [RFC 7636]. It was originally called OAuth SPOP (Symmetric Proof of Posession), but because it was expanded beyond symmetric keys, it was renamed Proof Key for Code Exchange (PKCE, pronounced “pixy,” meaning a fairy), which is what it is called today.
This specification addresses the Code Interception Attack vulnerability in OAuth 2.0 [RFC6749] Public Clients. It generates an ephemeral key and uses it to perform Proof of Possession of Key. It is backward compatible with RFC6749 and easy to implement, so I believe it should be used as a matter of course from now on.
I would like to express my deepest gratitude to Eduardo Gueiros, James Manger, Brian Campbell, Mike Jones, William Dennis, and everyone who participated in reviewing the security aspects of this specification. Likewise, I would like to thank everyone in the OAuth working group, the chairs, the area directors, and everyone at the IETF involved in developing this specification.
I would also like to note that this OAuth PKCE has already been widely adopted, including by the video-site app of a certain company.
[RFC6749] Hardt, D.: The OAuth 2.0 Authorization Framework (2012), https://tools.ietf.org/html/rfc6749
Related posts
I Will Speak at APIDays London (11/13)
This announcement could hardly be any later, but I will appear at APIDays London on the 13th from 11:10 a.m. local time. The APIDays London website…
I Will Appear on the Okinawa Open Days Panel “Current and Future OSS Initiatives in Economic Security”
It is already the day of the event—in fact, I am writing this now (12/4 9:45) at my desk while preparing for the panel—but I will…
The “DS-511 Guidelines for Handling Digital Identity in Identity Verification for Administrative Procedures, etc.” Have Been Published
After 3 years of development, the Digital Identity Guidelines, to which I had the privilege of contributing as an expert (Expert Meeting on the Revision of…