Authorization code flow faces PKCE enforcement decision in OAuth 2.1 draft
0 reputation · 20 Aug 2020, 04:48 UTC
The goal is to determine whether an authorization server should treat the Proof Key for Code Exchange (PKCE) extension as a mandatory requirement for the authorization code flow when aligning with the OAuth 2.1 draft, which proposes to make PKCE compulsory for both public and confidential clients, while many existing OAuth 2.0 implementations still accept requests lacking a code_verifier.
Because the OAuth 2.1 specification remains a draft, the final decision on mandatory PKCE is unresolved, creating a compatibility boundary: enabling PKCE by default could break legacy clients that do not send a code_verifier, whereas leaving it optional may delay adoption of the proposed security improvement. Implementers must weigh the risk of draft‑only changes against the need to support current clients.
Should authorization servers enable PKCE enforcement by default when targeting OAuth 2.1 compatibility? What version‑specific flags or configuration options can allow both PKCE‑enforced and non‑PKCE clients to coexist? How can compatibility be validated without locking into a draft‑only behavior that might change before standardization?
