Supported OAuth2 Flow: PKCE

Overview

AuthAction only supports the OAuth 2.0 Authorization Code Flow with PKCE (Proof Key for Code Exchange). This ensures a secure and standards-compliant authentication process, especially for public clients like Single Page Applications (SPAs), mobile apps, and desktop applications.

Why Only PKCE?

PKCE enhances security by preventing authorization code interception attacks and eliminates the need for client secrets, making it ideal for public clients.

Benefits of PKCE-Only Support:

• No client secrets required – Public clients can’t securely store secrets.
• Stronger security – Prevents code injection attacks.
• OAuth 2.1 Compliant – Aligns with the latest industry best practices.

Supported PKCE Code Challenge Method

AuthAction only supports S256 as the code challenge method. The plain method is not supported due to security concerns.

Parameter	Value
code_challenge_method	S256

How PKCE Works in AuthAction

1. Authorization Request

   • The client generates a code_verifier (random string).
   • A code_challenge is created by hashing code_verifier using SHA-256 and encoding it in base64url.
   • The client sends an authorization request including code_challenge and code_challenge_method=S256.

   GET /oauth2/authorize?
     response_type=code&
     client_id=YOUR_CLIENT_ID&
     redirect_uri=YOUR_REDIRECT_URI&
     code_challenge=BASE64URL_SHA256(CODE_VERIFIER)&
     code_challenge_method=S256

2. Token Exchange

   • The client exchanges the authorization code for tokens, sending the code_verifier in the request.

   POST /oauth2/token
   Content-Type: application/x-www-form-urlencoded
   
   grant_type=authorization_code&
   client_id=YOUR_CLIENT_ID&
   code=AUTHORIZATION_CODE&
   redirect_uri=YOUR_REDIRECT_URI&
   code_verifier=ORIGINAL_CODE_VERIFIER

3. Server Validation

   • AuthAction validates the code_verifier by applying SHA-256 and comparing it with the original code_challenge stored during authorization.
   • If valid, tokens are issued.

Limitations

• No support for plain PKCE (code_challenge_method=plain) – Only S256 is allowed.

---

If you have any questions or need assistance, please contact our support team.