Authorization Code Flow with PKCE

Help
1

I’m using this resource to get my auth flow working:
https://auth0.com/docs/flows/call-your-api-using-the-authorization-code-flow-with-pkce#example-post-to-token-url

When I send the Auth request, the user is redirected to the login page. Is there a recommended way to store the code_verifier while the redirect happens? Local storage? Cookie?

2

Per the possible storage types you mentioned I’m assuming this is a SPA so one possibility could be to use an higher-level SDK and leave that detail for the SDK. I think the Auth0 SPA SDK (Auth0 Single Page App SDK) uses cookies as the default storage mechanism for such data.

One advantage of cookies is that you can get automatic cleanup done by the browser for cases where a login request may be abandoned by the user.

2 Likes
3

Thanks! I’ll go for the cookie for now.

4

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.