VersolaVersola/docs
versola.kzGitHub
RUEN

RFC 7636 — PKCE

Proof Key for Code Exchange for OAuth Public Clients

Specification: RFC 7636

PKCE (Proof Key for Code Exchange) prevents authorization code interception attacks. OAuth 2.1 mandates it for all clients; Versola enforces it on every authorization request regardless of client type.

Code Verifier

  • Format validation: [A-Za-z0-9._~-] characters only
  • Length validation: 43–128 characters (Section 4.1)
  • Transmitted in token exchange as code_verifier

Code Challenge

  • S256 method: BASE64URL(SHA256(ASCII(code_verifier))) (Section 4.2)
  • plain method: code_challenge = code_verifier (Section 4.2)
  • Stored server-side and tied to the authorization code
  • Verified on token exchange before code is consumed

Authorization Request

  • code_challenge parameter — required (stricter than RFC: Versola rejects requests without it)
  • code_challenge_method parameter — optional, defaults to plain per spec
  • Invalid or missing code_challenge returns invalid_request error

Token Request

  • code_verifier parameter — required when PKCE was used
  • Server rejects mismatched verifier with invalid_grant
  • Replay protection: authorization code is single-use

Security Notes

Versola enforces PKCE on all authorization requests, not just public clients. plain is technically supported per RFC but S256 is strongly preferred and recommended.