ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Learn how PKCE lets SPAs and mobile apps use the OAuth 2.0 authorization code flow without storing a client secret, and see a concrete curl‑based example.
Implement OAuth 2.0 Authorization Code Flow with PKCE in a single‑page app: register the client, generate code_challenge, handle redirects, exchange tokens, validate ID tokens, store securely, and rotate refresh tokens. Verify each step with network tools and CSRF tests.
I need to verify that my Delphi VCL application can successfully obtain an access token from the Microsoft identity platform using the OAuth 2.0 authorization code flow with PKCE, while avoiding any use of production Azure AD credentials or real user data. The test environment must use a dedicated Azure AD test tenant, a localhost redirect URI that matches t
Goal: configure an OAuth client so that the same redirect URI value works in a local development environment (using http://localhost:8080/callback) and in a production environment where the provider requires an HTTPS URI that exactly matches the registered value, including any trailing slash or query parameters. Uncertainty: whether to enforce PKCE for all c
When implementing the Proof Key for Code Exchange (PKCE) extension with the S256 challenge method, authorization servers must verify that the submitted code_verifier matches the previously stored code_challenge. While RFC 7636 recommends a code_verifier length of 43 to 128 characters using unreserved characters, many client libraries accept shorter values, a
delphi