There has been a request from NMBE to upgrade our SSO to use PKCE (Proof Key for Code Exchange). The PKCE flow ensures that even if the authorization code is intercepted, an attacker cannot exchange it for an access token without the original code verifier. This makes the flow much more secure, especially for public clients.
Here is a link to the discussion in discourse https://discourse.specifysoftware.org/t/login-with-entraid-azure/1373/15
Describe the solution you'd like
To implement this PKCE upgrade in our Django project in the OAuth login process, we'll need to modify the login flow to include the generation of the "code_verifier" and "code_challenge".
Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.
Reported By
NMBE
There has been a request from NMBE to upgrade our SSO to use PKCE (Proof Key for Code Exchange). The PKCE flow ensures that even if the authorization code is intercepted, an attacker cannot exchange it for an access token without the original code verifier. This makes the flow much more secure, especially for public clients.
Here is a link to the discussion in discourse https://discourse.specifysoftware.org/t/login-with-entraid-azure/1373/15
Describe the solution you'd like
To implement this PKCE upgrade in our Django project in the OAuth login process, we'll need to modify the login flow to include the generation of the "code_verifier" and "code_challenge".
Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.
Reported By
NMBE