PKCE
Proof Key for Code Exchange
The client sends a hash of a one-time secret with the authorization request and the secret itself when redeeming the code, so a stolen code is useless. RFC 9700 requires it for public clients and recommends it for all others.
Covered in
Guide
OAuth 2.0 and OpenID Connect login: authorization code with PKCE
Implement OAuth 2.0 and OpenID Connect login with the authorization code flow and PKCE, keep each transaction bound to its browser, and block redirect, mix-up, code-injection and token-theft attacks.
Guide
Defend OAuth and OIDC against redirect and token attacks
Apply RFC 9700 and RFC 10017: exact redirect matching, PKCE with downgrade protection, state and iss binding, refresh-token rotation, sender-constrained tokens, and a backend-for-frontend so browser tokens cannot be stolen.
Practice: OAuth redirect and PKCE lab: Match redirect URIs and verify PKCE