PKCE และการรักษาความปลอดภัยให้ไคลเอ็นต์สาธารณะ

Mobile apps and SPAs are public clients: their code ships to the user, so they cannot safely store a client secret. Without a secret, the plain Authorization Code flow is vulnerable to interception.

PKCE (Proof Key for Code Exchange, pronounced 'pixy') adds a dynamic secret per authorization request. Even if the authorization code is stolen, it cannot be exchanged without the matching proof.

The client generates a random, high-entropy string called the code_verifier and keeps it in memory for this one flow.

The client hashes the verifier with SHA-256 to make the code_challenge. The hash is sent to the server, but the original verifier never leaves the device yet.

The client sends the challenge and the method (S256) to the authorization endpoint along with the usual parameters.

The authorization server remembers the code_challenge and links it to the authorization code it issues after the user logs in.

When swapping the code for tokens, the client now reveals the original code_verifier.

The server hashes the received verifier and compares it to the stored challenge. If they match, the requester is the same party that started the flow; otherwise it rejects the exchange.

An attacker who steals the authorization code (for example via a malicious app on the device) still cannot use it: they never saw the code_verifier, which existed only inside the legitimate client's memory.

Originally for mobile, PKCE is now recommended for every Authorization Code flow, including confidential web clients. OAuth 2.1 makes it the default.

You rarely implement PKCE by hand. Libraries like AppAuth, oidc-client-ts, and Spring Authorization Server handle verifier generation, hashing, and validation for you.

You learned how PKCE secures public clients:

• Public clients cannot keep a secret, so the plain code flow is unsafe
• The client creates a code_verifier and sends its hash as the code_challenge
• The verifier is revealed only at token exchange
• A stolen code is useless without the verifier

PKCE is now the default for all Authorization Code flows.