OAuth2 Authorization Code + PKCE Flow

Playback

Playback speed 1.0×

Security options

Enable PKCE (RFC 7636) protection Simulate a stolen authorization code

Protocol message

ReadyPress Play to run the flow.

Step

0 / 0

Attack outcome

n/a

No interception simulated

PKCE values (this session)

code_verifier—

code_challenge = BASE64URL(SHA256(verifier))—

How it works

This is the OAuth 2.1 Authorization Code flow with PKCE, the standard way a browser or mobile app gets access to an API on a user's behalf without ever handling the user's password.

code_verifier  = random 43-128 char string (this sim: 32 random bytes, base64url)
code_challenge = BASE64URL( SHA-256( code_verifier ) )
...at /authorize the client sends code_challenge only.
...at /token it proves possession by sending code_verifier.
Server check:  BASE64URL(SHA256(received_verifier)) == stored_challenge ?

Step / Play / Reset — walk through the 8-message exchange between Browser, Client App, Authorization Server and Resource Server.
Enable PKCE — toggles whether the Authorization Server enforces the verifier↔challenge check at the token endpoint. Turning it off reproduces the pre-2019 Authorization Code flow that PKCE was designed to replace.
Simulate a stolen authorization code — a malicious app on the same device intercepts the redirect that carries the one-time code (a real risk on mobile, where multiple apps can register the same custom URI scheme) and tries to exchange it for tokens itself.
With PKCE on, the attacker's request is rejected because it cannot supply the original code_verifier — only a SHA-256 preimage match is accepted. With PKCE off, the bare code is enough and the attacker walks away with a valid access token, which is exactly the class of attack RFC 7636 closed.
OpenID Connect layers an id_token (a signed JWT: header.payload.signature) on top of the same flow to additionally authenticate who the user is, not just authorize API access.

Legitimate message Attacker / rejected Token issuance

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.