OAuth PKCE --- Proof Key for Code Exchange by OAuth Public Client

介绍

在 OAuth 2.0 规范中 授权码 许可类型对于 Public Client (比如: SPA 或 Native APP) 这种客户端应用程序时, 安全性得不到有效的保证, 攻击者可能会拦截到认证服务器返回的授权码, 从而导致安全信息泄露.

    +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+
    | End Device (e.g., Smartphone)  |
    |                                |
    | +-------------+   +----------+ | (6) Access Token  +----------+
    | |Legitimate   |   | Malicious|<--------------------|          |
    | |OAuth 2.0 App|   | App      |-------------------->|          |
    | +-------------+   +----------+ | (5) Authorization |          |
    |        |    ^          ^       |        Grant      |          |
    |        |     \         |       |                   |          |
    |        |      \   (4)  |       |                   |          |
    |    (1) |       \  Authz|       |                   |