OAuth 2.0 Authorization Code + PKCE 11 Steps

How RFC 7636 S256 code_verifier & code_challenge bind authorization codes to public SPA clients

Step 1 of 11
time ↓
1User
OWNER

Approves scopes at IdP
2Browser
AGENT

Front-channel 302 transport
3SPA Client
PUBLIC

Holds secret code_verifier
4Authorization Server
IDP

Verifies S256(verifier)==challenge
5Resource Server
API

Enforces Bearer access token
!Attacker
THREAT

Lacks original code_verifier