0Pricing
Spring Security 6 & JWT Authentication · Lesson

PKCE and Securing Public Clients

Learn how the PKCE extension protects the OAuth2 Authorization Code flow for mobile and single-page apps that cannot keep a client secret.

PKCE and Securing Public Clients is a free Spring Security 6 & JWT Authentication lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Spring Security 6 & JWT Authentication learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

The Public Client Problem

Mobile apps and SPAs are public clients: their code ships to the user, so they cannot safely store a client secret. Without a secret, the plain Authorization Code flow is vulnerable to interception.

What PKCE Solves

PKCE (Proof Key for Code Exchange, pronounced 'pixy') adds a dynamic secret per authorization request. Even if the authorization code is stolen, it cannot be exchanged without the matching proof.

The Code Verifier

The client generates a random, high-entropy string called the code_verifier and keeps it in memory for this one flow.

const codeVerifier = base64url(randomBytes(32));

The Code Challenge

The client hashes the verifier with SHA-256 to make the code_challenge. The hash is sent to the server, but the original verifier never leaves the device yet.

const codeChallenge = base64url(sha256(codeVerifier));

Starting the Authorization Request

The client sends the challenge and the method (S256) to the authorization endpoint along with the usual parameters.

GET /authorize?response_type=code
  &client_id=app123
  &code_challenge=XYZ...
  &code_challenge_method=S256

Server Stores the Challenge

The authorization server remembers the code_challenge and links it to the authorization code it issues after the user logs in.

Exchanging the Code

When swapping the code for tokens, the client now reveals the original code_verifier.

POST /token
  grant_type=authorization_code
  &code=abc123
  &code_verifier=ORIGINAL_RANDOM

Server Verifies the Proof

The server hashes the received verifier and compares it to the stored challenge. If they match, the requester is the same party that started the flow; otherwise it rejects the exchange.

if (sha256(received_verifier) !== stored_challenge) {
  reject('invalid_grant');
}

Why It Stops Interception

An attacker who steals the authorization code (for example via a malicious app on the device) still cannot use it: they never saw the code_verifier, which existed only inside the legitimate client's memory.

PKCE Is Now Recommended for All

Originally for mobile, PKCE is now recommended for every Authorization Code flow, including confidential web clients. OAuth 2.1 makes it the default.

Library Support

You rarely implement PKCE by hand. Libraries like AppAuth, oidc-client-ts, and Spring Authorization Server handle verifier generation, hashing, and validation for you.

Quick Check

Test your understanding of PKCE.

Recap

You learned how PKCE secures public clients:

  • Public clients cannot keep a secret, so the plain code flow is unsafe
  • The client creates a code_verifier and sends its hash as the code_challenge
  • The verifier is revealed only at token exchange
  • A stolen code is useless without the verifier

PKCE is now the default for all Authorization Code flows.

Frequently asked questions

Is the “PKCE and Securing Public Clients” lesson free?

Yes — the full text of “PKCE and Securing Public Clients” is free to read here on the web, and the Spring Security 6 & JWT Authentication course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Spring Security 6 & JWT Authentication course, upgrade to CoddyKit PRO.

What will I learn in “PKCE and Securing Public Clients”?

Learn how the PKCE extension protects the OAuth2 Authorization Code flow for mobile and single-page apps that cannot keep a client secret. You practise Spring Security 6 & JWT Authentication with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Spring Security 6 & JWT Authentication?

No prior experience is required. Spring Security 6 & JWT Authentication on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “PKCE and Securing Public Clients” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Spring Security 6 & JWT Authentication lesson?

Yes. Every Spring Security 6 & JWT Authentication lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. OAuth2 Protocol Overview
  2. OpenID Connect Introduction
  3. Common OAuth2 Grant Types
  4. PKCE and Securing Public Clients
← Back to Spring Security 6 & JWT Authentication