RFC 9700 / ATTACKS & DEFENSES

Authorization code injection

An attacker injects a stolen code into their own app session so the legitimate app connects that session to the victim’s resources.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

DIAGRAM§ 4.5 ↗

RFC 9700 · § 4.5DEFENSE

3 / 3

Reject the code exchange.

The code’s stored challenge does not match the verifier supplied by this client transaction.

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references

WHAT CHANGED

RFC 6749 § 10.5RFC 9700 § 4.5.3

The later BCP details code injection into another client session and transaction binding through PKCE or, with extra precautions, OIDC nonce.

Read the updated RFC section ↗

KEY POINT

Bind codes to a client instance and transaction.

PKCE rejects injected codes whose challenge does not match this transaction’s verifier.
Confidential OIDC clients using nonce MUST verify it in the token-endpoint ID Token and disregard all tokens until the check succeeds.
Keep preventing response leakage: modifying request challenges or nonces and stealing responses can undermine these defenses.

DETAILS

Client authentication alone does not stop injection because the legitimate app authenticates on the attacker’s behalf. Nonce alone does not protect public-client codes from direct redemption.

Read the RFC section ↗

Diagrams simplify the RFC. Read the linked sections for complete requirements.

Privacy

All chapters in this RFC