PKCE Generator: Code Verifier & Code Challenge

What is PKCE?

PKCE (Proof Key for Code Exchange, pronounced "pixy", defined in RFC 7636) is an extension to the OAuth 2.0 authorization code flow that stops an intercepted authorization code from being redeemed by anyone other than the client that started the flow.

Why does OAuth 2.1 require PKCE for all clients?

Under OAuth 2.0, PKCE was mainly recommended for public clients (SPAs, mobile and native apps) that can't hold a client secret. OAuth 2.1 makes it mandatory for every client using the authorization code flow, confidential or not, because it's cheap defense-in-depth against authorization code interception regardless of how the client authenticates.

S256 vs. plain

With S256, the client sends code_challenge = BASE64URL(SHA256(code_verifier)) at the start of the flow, and sends the real code_verifier only at the token exchange, so the verifier is never exposed on the (less-protected) front channel. With plain, code_challenge is just the verifier itself. Always use S256. (To check a base64url value by hand, use the Base64URL decoder.)

How does the PKCE flow work, step by step?

1. Client generates a random code_verifier. RFC 7636 requires 43-128 characters from an unreserved character set (A-Z a-z 0-9 - . _ ~); 64 characters is a reasonable default.
2. Client derives code_challenge from it (S256) and sends it with the authorization request.
3. User authenticates and consents at the authorization server.
4. Authorization server redirects back with an authorization code.
5. Client exchanges the code for tokens at the token endpoint, sending the original code_verifier.
6. Authorization server hashes the verifier and compares it to the stored challenge. Tokens are issued only if they match.

How do I enable PKCE in .NET and Duende IdentityServer?

ASP.NET Core's OpenID Connect handler enables PKCE by default (OpenIdConnectOptions.UsePkce = true). On the server side, Duende IdentityServer lets you require it per client with Client.RequirePkce (on by default for new clients): see client configuration in IdentityServer.

Computing the S256 challenge server-side in .NET 9+ is a few lines with SHA256.HashData and the new System.Buffers.Text.Base64Url type:

using System.Security.Cryptography;
using System.Buffers.Text;

// code_verifier: any RFC 7636-compliant random string, 43-128 chars
var verifierBytes = RandomNumberGenerator.GetBytes(32);
var codeVerifier = Base64Url.EncodeToString(verifierBytes);

// code_challenge = BASE64URL(SHA256(code_verifier))
var challengeBytes = SHA256.HashData(Encoding.ASCII.GetBytes(codeVerifier));
var codeChallenge = Base64Url.EncodeToString(challengeBytes);