Authorization Code With PKCE Implementation Checklist Form
Use this checklist to review and confirm the readiness, security, and correct configuration of your OAuth 2.0 Authorization Code with PKCE implementation.
Code verifier is generated with sufficient entropy and length (43-128 characters, using allowed characters).
Completed
Code challenge is derived from the code verifier using the S256 method (SHA-256 and base64url encoding).
Completed
Authorization request includes the code_challenge and code_challenge_method parameters.
Completed
Token request includes the code_verifier parameter and is validated by the authorization server.
Completed
State parameter is used and validated to protect against CSRF attacks.
Completed
Redirect URI is pre-registered and validated on every authorization and token request.
Completed
Authorization code is single-use and expires after a short period.
Completed
Error handling is implemented for invalid or missing PKCE parameters.
Completed
Implementation is tested against known PKCE attack vectors (e.g., code injection, code interception).
Completed
All relevant OAuth 2.0 and PKCE best practices are reviewed and documented.
Completed
Submit Checklist
Should be Empty: