Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Support PKCE (Proof Key for Code Exchange)

See original GitHub issue

As part of using UAA for mobile SSO use-cases (see https://tools.ietf.org/html/draft-ietf-oauth-native-apps-03), the ability to protect authorization codes relies on Proof Key for Code Exchange (PKCE) support specified in https://tools.ietf.org/html/rfc7636

The UAA api does not seem to yet support the related code_challenge endpoint parameters of PKCE as an example.

Is there anything planned to support PKCE in the future ?

Issue Analytics

State:
Created 7 years ago
Comments:5 (1 by maintainers)

Top GitHub Comments

4reactions

minyangucommented, Jan 8, 2019

@sreetummidi Hi, same question, why UAA has no plan to implement the PKCE for mobile apps?

Please also note this: The OAuth 2.0 Security Best Current Practice document recommends against using the Implicit flow entirely, and OAuth 2.0 for Browser-Based Apps describes the technique of using the authorization code flow with PKCE.

Although this is still under draft status, this may soon become a confirmed standard by IETF so that browser-based apps like SPA are also required to use the Auth Code + PKCE flow mechanism.

3reactions

mabesharkcommented, Apr 28, 2018

@sreetummidi Hi is there a reason there are no plans to implement PKCE in UAA?

Top Results From Across the Web

Authorization Code Flow with Proof Key for Code Exchange ...

Learn how the Authorization Code flow with Proof Key for Code Exchange (PKCE) works and why you should use it for native and...

Protecting Apps with PKCE - OAuth 2.0 Simplified

Proof Key for Code Exchange (abbreviated PKCE, pronounced “pixie”) is an extension to the authorization code flow to prevent CSRF and ...

What the heck is PKCE? - Medium

PKCE is short for Proof Key for Code Exchange. It is a mechanism that came into being to make the use of OAuth...

Proof Key for Code Exchange (PKCE)

PKCE is an extension to the authorization code flow to prevent interception attacks from public clients. ... The PKCE extension introduces two temporary...

Proof Key for Code Exchange (PKCE) - JackHenry.Dev

The Proof Key for Code Exchange (PKCE) extension adds additional security to the OAuth 2.0 Authorization Code flow. PKCE is often pronounced/referenced as ......