In order to support native apps, we are using the auth code flow with PKCE. In testing things though, we’ve found that if an authorization request is made without a code_challenge and code_verifier, the request will proceed as normal. When the auth code returns to the application, the application ca…

Hi @jlnaps . There’s currently no setting to enforce usage of the PKCE. As you know, the purpose of the PKCE is to ensure that the authorization code can only be exchanged by the application that made the authorization request, but it’s the application responsibility to properly implement this secu…

Require a code_challenge and code_verifier on auth code with PKCE grant

Get Help

system Closed January 11, 2019, 11:50am 3

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Code Verifier Storage and Retrieval Get Help	5	6798	April 6, 2022
“Failed to verify code verifier” Error after Users Authenticates JWT.io jwt , pkce , code-verifier	2	540	November 27, 2024
Code Verifier Issues in Authorization Flow with PKCE in ReactNative Expo Get Help auth0 , authorization	0	2451	August 9, 2022
RFC 7636 violation - Weak enforcement of PKCE parameters in OAuth 2.0 implementation Product Feedback auth0 , security , authorization , pkce , code-verifier	0	10	May 21, 2025
Auth Code + PKCE. Secret VS No Secret? Get Help jwt , auth0 , pkce	5	4901	April 14, 2021

Require a code_challenge and code_verifier on auth code with PKCE grant

Related topics