A browser round trip, protected by PKCE
02Public native apps need a proof that binds the authorization request to its code exchange.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 6 ↗
RFC 8252 · § 6EXAMPLE
4 / 4
04
The initiating app redeems the code.
The token endpoint verifies the binding.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
RFC 8252 § 8.1RFC 9700 § 2.1.1
The later BCP explicitly requires PKCE for all public clients and recommends it for confidential clients, with downgrade prevention at the server.
Read the updated RFC section ↗An intercepted code should be unusable alone.
- Public native apps MUST implement PKCE, and authorization servers MUST support it for them.
- Generate a fresh verifier and send the corresponding challenge with the initial request.
- Servers SHOULD reject native-app authorization requests that omit PKCE (§ 8.1).
RFC 9700 later extends explicit PKCE requirements across public OAuth clients, not just native apps.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy