OAuth and OIDC

Authorization Code with PKCE

Bind an authorization request to a one-time verifier using the S256 challenge method.

Create the challenge

Generate a high-entropy verifier for every authorization attempt. Hash its ASCII value with SHA-256 and base64url-encode the result without padding. Keep the verifier in the client until the callback.

import { createHash, randomBytes } from "node:crypto";

const verifier = randomBytes(48).toString("base64url");
const challenge = createHash("sha256")
  .update(verifier)
  .digest("base64url");

Authorize

Store state with the verifier and compare it at the callback. OIDC clients should also send nonce and compare it with the ID-token claim.

GET /oauth/authorize?response_type=code
  &client_id=CLIENT_ID
  &redirect_uri=https%3A%2F%2Fclient.example%2Fcallback
  &scope=openid%20profile
  &state=RANDOM_STATE
  &nonce=RANDOM_NONCE
  &code_challenge=CHALLENGE
  &code_challenge_method=S256

Exchange once

curl -u "$CLIENT_ID:$CLIENT_SECRET" \
  -H "content-type: application/x-www-form-urlencoded" \
  -d grant_type=authorization_code \
  -d code="$CODE" \
  -d redirect_uri=https://client.example/callback \
  -d code_verifier="$VERIFIER" \
  https://authometry.ch3n.cc/oauth/token

The code is short-lived and single-use. A verifier mismatch or replay returns invalid_grant.