New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use PKCE when requesting authorisation from an IndieAuth server #236

Open

paulrobertlloyd opened this issue Nov 23, 2022 · 0 comments

paulrobertlloyd commented Nov 23, 2022

It’s recommended that clients interacting with an IndieAuth server use PKCE (Proof Key Code Exchange) in their request to improve security.

Many servers still allow this to be optional, although the latest version of the IndieAuth spec says this is now required:

All IndieAuth clients MUST use PKCE ([RFC7636]) to protect against authorization code injection and CSRF attacks.

IndieAuth servers typically display a warning if a client is not using PKCE.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment