PKCE (Proof Key for Code Exchange)

PKCE (Proof Key for Code Exchange, RFC 7636, prononcé "pixie") est une extension OAuth 2.0 critical, originalement conçue pour mobile/native apps, maintenant mandatory pour TOUS clients OAuth (web, SPA, mobile, native) selon OAuth 2.1. Prevents authorization code interception attacks même quand client secret n'est pas disponible.

Problème résolu : sans PKCE, un attaquant interceptant le authorization code (via URL scheme hijacking sur mobile, redirect_uri manipulation, network logs) peut l'échanger contre tokens. Avec PKCE, il faut ALSO know the code_verifier — secret known only to legitimate client.

Fonctionnement :
(1) Client génère cryptographically random **code_verifier** (43-128 chars, [A-Z][a-z][0-9]-._~).
(2) Client compute **code_challenge** = base64url(SHA256(code_verifier)). (Plain method = code_verifier same as challenge — discouraged, S256 recommended.)
(3) Client envoie `/authorize` request avec `code_challenge=...&code_challenge_method=S256`.
(4) IdP stocke code_challenge associated to issued authorization code.
(5) User auth, IdP redirects avec code.
(6) Client POST `/token` avec `code=...&code_verifier=<original_verifier>`.
(7) IdP vérifie SHA256(code_verifier) == stored code_challenge.
(8) Match → returns tokens. Mismatch → reject.

Why attacker can't bypass :
- Attacker intercepts code → tries to exchange.
- Attacker doesn't have code_verifier (kept in client memory only).
- Cannot reverse SHA256 to derive code_verifier from code_challenge.
- Exchange fails.

Use cases :
(1) **Mobile apps** (iOS, Android) — no secret possible (apps decompilable).
(2) **SPAs** (React, Vue, Angular) — no secret (JS source viewable).
(3) **Native desktop apps**.
(4) **CLI tools** with OAuth.
(5) **Web apps with backend** — PKCE additional security même avec client secret.

Implementation libraries auto-handle PKCE :
- **Auth0 SPA SDK, MSAL.js** (Microsoft), **react-oidc-context**, **angular-auth-oidc-client**.
- **Apple Sign in with Apple** — requires PKCE.
- **OIDC server libraries** all support (auth0, Okta, Keycloak, IdentityServer).

OAuth 2.1 mandates :
(1) PKCE for all clients (not just public).
(2) S256 method preferred.
(3) Implicit Flow removed.
(4) ROPC removed.
(5) Exact match redirect_uri required (no string prefix matching).

Real-world : Apps not using PKCE for mobile = audit fail, common bug bounty finding for OAuth implementations. Compétences SC-300, AZ-500, CISSP.