Do not downgrade the method
05An S256 error is not permission to retry with plain or omit PKCE.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 7.2 ↗
RFC 7636 · § 7.2EXAMPLE
3 / 3
03
Stop downgrade
Fail safely rather than retrying with a weaker method.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
RFC 7636 § 7.2RFC 9700 § 4.8
Later OAuth guidance explicitly addresses PKCE downgrade attacks and requires servers to enforce the request’s proof-key binding.
Read the updated RFC section ↗Clients must not downgrade to plain after trying S256.
- Clients must not downgrade to plain after trying S256.
- An observer of a plain challenge also learns the verifier value.
- Use modern server-side downgrade protections from the OAuth security BCP.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy