{
  "id": "security/oauth2-pkce-code-verifier-missing",
  "signature": "OAuth2 authorization code exchange failed: PKCE code_verifier is required but was not provided",
  "signature_zh": "OAuth2授权码交换失败：需要PKCE code_verifier但未提供",
  "regex": "OAuth2 authorization code exchange failed: PKCE code_verifier is required but was not provided",
  "domain": "security",
  "category": "protocol_error",
  "subcategory": null,
  "root_cause": "The authorization server requires PKCE (Proof Key for Code Exchange) for the token exchange, but the client did not send the 'code_verifier' parameter, often because the client library or configuration does not support PKCE.",
  "root_cause_type": "generic",
  "root_cause_zh": "授权服务器要求令牌交换时使用PKCE（代码交换证明密钥），但客户端未发送'code_verifier'参数，通常是因为客户端库或配置不支持PKCE。",
  "versions": [
    {
      "version": "Spring Security OAuth2 5.8.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "oauthlib 3.2.2",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "oidc-client-ts 2.2.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "IdentityServer4 4.1.2",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "Sending a static 'code_verifier' value for all users makes the PKCE challenge predictable, allowing an attacker to intercept the authorization code and use the known verifier to exchange it.",
      "fail_rate": 0.7,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Disabling PKCE enforcement on the authorization server reduces security and may not be possible if the server is managed by a third party.",
      "fail_rate": 0.5,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Reusing the same 'code_verifier' across multiple authorization requests can lead to replay attacks and is against the PKCE specification.",
      "fail_rate": 0.6,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Generate a random 'code_verifier' per authorization request and store it in the session. For example, in Python: `import secrets; code_verifier = secrets.token_urlsafe(64)`. Then send it during the token exchange.",
      "success_rate": 0.9,
      "how": "Generate a random 'code_verifier' per authorization request and store it in the session. For example, in Python: `import secrets; code_verifier = secrets.token_urlsafe(64)`. Then send it during the token exchange.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Use a modern OAuth2 client library that supports PKCE by default, such as `oauthlib` in Python or `oidc-client-ts` in JavaScript. Configure it to enable PKCE.",
      "success_rate": 0.85,
      "how": "Use a modern OAuth2 client library that supports PKCE by default, such as `oauthlib` in Python or `oidc-client-ts` in JavaScript. Configure it to enable PKCE.",
      "condition": "",
      "sources": []
    },
    {
      "action": "If using a custom implementation, ensure the 'code_challenge' and 'code_challenge_method' are included in the authorization request and the 'code_verifier' is sent in the token request.",
      "success_rate": 0.8,
      "how": "If using a custom implementation, ensure the 'code_challenge' and 'code_challenge_method' are included in the authorization request and the 'code_verifier' is sent in the token request.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "每次授权请求生成一个随机的'code_verifier'并存储在会话中。例如，在Python中：`import secrets; code_verifier = secrets.token_urlsafe(64)`。然后在令牌交换时发送它。",
    "使用默认支持PKCE的现代OAuth2客户端库，例如Python的`oauthlib`或JavaScript的`oidc-client-ts`。配置以启用PKCE。",
    "如果使用自定义实现，确保授权请求中包含'code_challenge'和'code_challenge_method'，并在令牌请求中发送'code_verifier'。"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://oauth.net/2/pkce/",
  "official_doc_section": null,
  "error_code": "OAUTH2_PKCE_MISSING",
  "verification_tier": "ai_generated",
  "confidence": 0.88,
  "fix_success_rate": 0.9,
  "resolvable": "true",
  "first_seen": "2023-05-20",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}