BCP_4_8

PKCE Downgrade Attack

An authorization server that supports PKCE but does not make its use mandatory for all flows can be susceptible to a PKCE downgrade attack.

OAuth 2.0 Security Best Current Practice (SecBCP, section 4.8)

Mitigations

This threat is considered fully mitigated if all the test cases from the following test set succeed.

• Set #1
• Pkce.IsPkceDowngradeDetectedTest
• Pkce.IsPkcePlainDowngradeDetectedTest

Back to the threat overview