Skip to content

How to enable PKCE(Proof Key for Code Exchange) when OAuth2.0 authorization code grant is used #163

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
mingqin1 opened this issue Sep 22, 2017 · 1 comment

Comments

@mingqin1
Copy link

Hi Dave:
OAuth 2.0 public clients using the authorization code grant are susceptible to the
authorization code interception attack. The PKCE specification( https://tools.ietf.org/html/rfc7636) has been introduced as a way to defend from this attack by establishing a secure binding between the authorization
request and the subsequent token request.
Is Spring-Security-OAuth already implemented PKCE ?

@dsyer
Copy link
Collaborator

dsyer commented Sep 22, 2017

@dsyer dsyer closed this as completed Sep 22, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants