OAUTH2_PKCE_MISSING security protocol_error ai_generated true

OAuth2 authorization code exchange failed: PKCE code_verifier is required but was not provided

ID: security/oauth2-pkce-code-verifier-missing

Also available as: JSON · Markdown · 中文
90%Fix Rate
88%Confidence
1Evidence
2023-05-20First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
Spring Security OAuth2 5.8.0 active — — —
oauthlib 3.2.2 active — — —
oidc-client-ts 2.2.0 active — — —
IdentityServer4 4.1.2 active — — —

Root Cause

The authorization server requires PKCE (Proof Key for Code Exchange) for the token exchange, but the client did not send the 'code_verifier' parameter, often because the client library or configuration does not support PKCE.

generic

中文

授权服务器要求令牌交换时使用PKCE（代码交换证明密钥），但客户端未发送'code_verifier'参数，通常是因为客户端库或配置不支持PKCE。

Official Documentation

https://oauth.net/2/pkce/

Workarounds

  1. 90% success Generate a random 'code_verifier' per authorization request and store it in the session. For example, in Python: `import secrets; code_verifier = secrets.token_urlsafe(64)`. Then send it during the token exchange. 
    Generate a random 'code_verifier' per authorization request and store it in the session. For example, in Python: `import secrets; code_verifier = secrets.token_urlsafe(64)`. Then send it during the token exchange.
  2. 85% success Use a modern OAuth2 client library that supports PKCE by default, such as `oauthlib` in Python or `oidc-client-ts` in JavaScript. Configure it to enable PKCE. 
    Use a modern OAuth2 client library that supports PKCE by default, such as `oauthlib` in Python or `oidc-client-ts` in JavaScript. Configure it to enable PKCE.
  3. 80% success If using a custom implementation, ensure the 'code_challenge' and 'code_challenge_method' are included in the authorization request and the 'code_verifier' is sent in the token request. 
    If using a custom implementation, ensure the 'code_challenge' and 'code_challenge_method' are included in the authorization request and the 'code_verifier' is sent in the token request.

中文步骤

  1. 每次授权请求生成一个随机的'code_verifier'并存储在会话中。例如，在Python中：`import secrets; code_verifier = secrets.token_urlsafe(64)`。然后在令牌交换时发送它。
  2. 使用默认支持PKCE的现代OAuth2客户端库，例如Python的`oauthlib`或JavaScript的`oidc-client-ts`。配置以启用PKCE。
  3. 如果使用自定义实现，确保授权请求中包含'code_challenge'和'code_challenge_method'，并在令牌请求中发送'code_verifier'。

Dead Ends

Common approaches that don't work:

  1. 70% fail

    Sending a static 'code_verifier' value for all users makes the PKCE challenge predictable, allowing an attacker to intercept the authorization code and use the known verifier to exchange it.

  2. 50% fail

    Disabling PKCE enforcement on the authorization server reduces security and may not be possible if the server is managed by a third party.

  3. 60% fail

    Reusing the same 'code_verifier' across multiple authorization requests can lead to replay attacks and is against the PKCE specification.