RFC 7636 Deep Dive: How PKCE Kills Authorization Code Interception Attacks

<p>Two CVEs against the same identity provider, filed six months apart. CVE-2023-48228 and CVE-2024-23647, both against authentik, describe the same failure: the server accepted

<p>If you've tried to add Google OAuth to a SPA or a Next.js app, you've probably run into the same friction: Google's documentation is comprehensive but dense, most tutorials are

<p>JWT (JSON Web Tokens) have become a default choice for authentication and authorisation in modern systems.</p> <p>They are widely adopted because they are:</p> <ul>

<h1> How I built keyless OAuth sign-in for my AI companion: PKCE, a single-use loopback callback, and a token that never touches disk </h1> <p>Ankita is my open-source desktop AI

<p>The OAuth flow has four participants: client, authorization server, resource server, and, when <code>state</code> is absent, the attacker. RFC 6749 made the only CSRF control

<h2> Preface: </h2> <p>In the past six months or so, connecting AI Agents directly to internal systems to help get things done is no longer news. However, if you think one step