RFC 7636 — PKCE — Versola Docs
/docs
Pre-1.00.7.5versola.ioGitHub
RUEN

RFC 7636 — PKCE

Proof Key for Code Exchange — S256 only, required for public clients and for every client of a fapi2 tenant.

Specification: RFC 7636

PKCE prevents authorization code interception. Versola supports the S256 method only, and requires it for public clients, for clients of apps fronted by edge, and for every client of a fapi2 tenant.

Status

Implemented. Checked claims: 12 of 13.

Code verifier

  • Format validation: [A-Za-z0-9._~-] characters only
  • Length validation: 43–128 characters (Section 4.1)
  • Sent in the token exchange as code_verifier

Code challenge

  • S256 method: BASE64URL(SHA256(ASCII(code_verifier))) (Section 4.2)
  • plain method — not accepted; rejected at /authorize and /par (PushedAuthorizationSpec)
  • Challenge stored with the authorization code and checked before the code is consumed
  • A code issued against a challenge is redeemable only with the matching verifier; a code issued with none is redeemable only without one

Authorization request

  • code_challenge — required, with these exceptions in the next line
  • code_challenge required for confidential clients of a standard tenant — optional there, because the client secret already proves who redeems the code (public clients, edge-fronted native apps and every fapi2 client still need it)
  • code_challenge_method — required whenever a challenge is sent; a method with no challenge is refused even where PKCE is optional
  • A malformed or missing challenge returns invalid_request

Token request

  • code_verifier required when the code carries a challenge
  • A mismatched verifier is refused with invalid_grant
  • The authorization code is single use

Notes

  • Omitting code_challenge_method does not default to plain, as the RFC would have it: S256 must be named.
  • code_challenge_methods_supported advertises S256 only.

Where to look

Security profiles shows when PKCE is optional and when it is not.