# OAuth2 authorization code exchange failed: PKCE code_verifier is required but was not provided

- **ID:** `security/oauth2-pkce-code-verifier-missing`
- **Domain:** security
- **Category:** protocol_error
- **Error Code:** `OAUTH2_PKCE_MISSING`
- **Verification:** ai_generated
- **Fix Rate:** 90%

## Root Cause

The authorization server requires PKCE (Proof Key for Code Exchange) for the token exchange, but the client did not send the 'code_verifier' parameter, often because the client library or configuration does not support PKCE.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Spring Security OAuth2 5.8.0 | active | — | — |
| oauthlib 3.2.2 | active | — | — |
| oidc-client-ts 2.2.0 | active | — | — |
| IdentityServer4 4.1.2 | active | — | — |

## Workarounds

1. **Generate a random 'code_verifier' per authorization request and store it in the session. For example, in Python: `import secrets; code_verifier = secrets.token_urlsafe(64)`. Then send it during the token exchange.** (90% success)
   ```
   Generate a random 'code_verifier' per authorization request and store it in the session. For example, in Python: `import secrets; code_verifier = secrets.token_urlsafe(64)`. Then send it during the token exchange.
   ```
2. **Use a modern OAuth2 client library that supports PKCE by default, such as `oauthlib` in Python or `oidc-client-ts` in JavaScript. Configure it to enable PKCE.** (85% success)
   ```
   Use a modern OAuth2 client library that supports PKCE by default, such as `oauthlib` in Python or `oidc-client-ts` in JavaScript. Configure it to enable PKCE.
   ```
3. **If using a custom implementation, ensure the 'code_challenge' and 'code_challenge_method' are included in the authorization request and the 'code_verifier' is sent in the token request.** (80% success)
   ```
   If using a custom implementation, ensure the 'code_challenge' and 'code_challenge_method' are included in the authorization request and the 'code_verifier' is sent in the token request.
   ```

## Dead Ends

- **** — Sending a static 'code_verifier' value for all users makes the PKCE challenge predictable, allowing an attacker to intercept the authorization code and use the known verifier to exchange it. (70% fail)
- **** — Disabling PKCE enforcement on the authorization server reduces security and may not be possible if the server is managed by a third party. (50% fail)
- **** — Reusing the same 'code_verifier' across multiple authorization requests can lead to replay attacks and is against the PKCE specification. (60% fail)