What is PKCE in ForgeRock AM and why is it important for public clients?

PKCE stands for Proof Key for Code Exchange (RFC 7636). It is a security extension to the OAuth 2.0 Authorization Code flow that protects against the authorization code interception attack — a threat where a malicious app on the same device intercepts the authorization code before the legitimate application can exchange it for a token.

The attack is possible because, on mobile and desktop platforms, multiple apps can register for the same custom URI scheme (e.g., myapp://callback). When AM redirects back after authentication, any app registered for that scheme can receive the code. Without PKCE, the malicious app could exchange the stolen code for tokens.

PKCE adds a cryptographic challenge/verifier pair to the flow:

1. The client generates a cryptographically random code verifier (a high-entropy string).
2. The client computes a code challenge by hashing the verifier with SHA-256 (S256 method) and base64url-encoding it.
3. The client sends the code_challenge and code_challenge_method=S256 in the authorization request to AM.
4. AM stores the challenge with the authorization code in CTS.
5. When the client exchanges the code, it sends the original code_verifier.
6. AM hashes the verifier and compares it against the stored challenge. They must match for the exchange to succeed.

A malicious app that intercepts only the authorization code cannot complete the exchange because it does not know the original code verifier. In ForgeRock AM, PKCE can be enforced on a per-client basis. For AM 7.x, PKCE is mandatory by default for public clients (those without a client secret) and strongly recommended for all Authorization Code flows. This aligns with OAuth 2.1's direction of making PKCE universally required.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.