Derive the S256 challenge
02The challenge commits the request to the verifier without sending that verifier to the authorization endpoint.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 4.2 ↗
RFC 7636 · § 4.2EXAMPLE
3 / 3
03
Base64url
Send the resulting challenge with code_challenge_method=S256.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
S256 is BASE64URL(SHA256(ASCII(verifier))).
- S256 is BASE64URL(SHA256(ASCII(verifier))).
- A client capable of S256 must use it.
- The plain method has narrower protection and must not be a fallback after S256 fails.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy