------------------------------------------------------------------ == PKCE parameters (RFC 7636) ------------------------------------------------------------------ code_verifier BTbNq-KzR5R5zjPoT5s8JVMvvweKRQq_dMcGF-2P7Ea8-lku7Jgv0Na6RZkxBjlY (64 chars) code_challenge B_BI3Dk68d1epKthalJJxOKFAN0mf3FkUOoJRuV26kM code_challenge_method S256 The verifier never leaves the client until the token request. The challenge is all the authorization request carries, and it is a one-way hash of the verifier. ------------------------------------------------------------------ == 1. Log in to the authorization server (browser session) ------------------------------------------------------------------ $ curl -c jar -d username=alice -d password=password -d _csrf= http://localhost:9000/login HTTP/1.1 302 Location: http://localhost:9000/ ------------------------------------------------------------------ == 2. GET /oauth2/authorize (client=demo-spa) ------------------------------------------------------------------ NO_CHALLENGE=1: the authorization request carries no code_challenge. $ curl -b jar 'http://localhost:9000/oauth2/authorize?response_type=code&client_id=demo-spa&redirect_uri=http%3A%2F%2F127.0.0.1%3A8080%2Fauthorized&scope=openid%20orders.read&state=xyz123' -> 302 http://127.0.0.1:8080/authorized?error=invalid_request&error_description=OAuth%202.0%20Parameter%3A%20code_challenge&error_uri=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Frfc7636%23section-4.4.1&state=xyz123 ------------------------------------------------------------------ == 3. No consent page ------------------------------------------------------------------ The authorization endpoint went straight back to the client. Either consent is off for this client, or every requested scope was already approved. ------------------------------------------------------------------ == 5. The authorization code ------------------------------------------------------------------ code = state = xyz123 (the client's own value, returned untouched - compare it) no code in the redirect. The error was: http://127.0.0.1:8080/authorized?error=invalid_request error_description=OAuth%202.0%20Parameter%3A%20code_challenge error_uri=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Frfc7636%23section-4.4.1 state=xyz123