tag: code-flow
Authorization code flow
The OAuth 2.0 authorization code grant, with PKCE: the recommended flow for web, mobile and single-page apps.
Articles
- Authorization
The State Parameter in OAuth 2.0: CSRF, PKCE and RFC 9700
Why OAuth 2.0's state parameter exists, the CSRF attack it stops, how to generate and check it, and how state, PKCE and nonce divide the work under RFC 9700.
- Mobile security
Integrating OAuth With Mobile Apps: The Native App Pattern
How native iOS and Android apps should use OAuth 2.0: system browser, PKCE, claimed HTTPS redirects, secure token storage and what to avoid (embedded webviews).
Guides
- Topic guide
OAuth security: what to get right
A practical OAuth 2.0 security guide based on RFC 9700: choose the right flow, use PKCE and state, validate redirects, limit tokens, protect refresh tokens and APIs.
- Topic guide
OAuth downgrade attacks
How attackers push OAuth flows to weaker options: PKCE downgrade, plain challenges, implicit fallback, server mix-up, and the checks that stop them.