{
  "number": 7636,
  "title": "Proof Key for Code Exchange by OAuth Public Clients",
  "authors": [
    "N. Sakimura, Ed.",
    "J. Bradley",
    "N. Agarwal"
  ],
  "published": "2015-09",
  "status": "Proposed Standard",
  "stream": "IETF",
  "area": "sec",
  "working_group": "oauth",
  "pages": 20,
  "formats": [
    "TXT",
    "HTML"
  ],
  "abstract": "OAuth 2.0 public clients utilizing the Authorization Code Grant are susceptible to the authorization code interception attack. This specification describes the attack as well as a technique to mitigate against the threat through the use of Proof Key for Code Exchange (PKCE, pronounced \"pixy\").",
  "keywords": [
    "smart phones",
    "apps",
    "XARA",
    "authorization",
    "custom scheme",
    "intent",
    "man-in-the-middle",
    "eavesdropping",
    "user agent swap",
    "spop",
    "pop",
    "openid",
    "connect",
    "pkce",
    "pixie"
  ],
  "draft": "draft-ietf-oauth-spop-15",
  "doi": "10.17487/RFC7636",
  "errata_url": "https://www.rfc-editor.org/errata/rfc7636",
  "urls": {
    "html": "https://rfc.dk/rfc7636/",
    "text": "https://rfc.dk/rfc7636.txt",
    "rfc_editor": "https://www.rfc-editor.org/rfc/rfc7636",
    "datatracker": "https://datatracker.ietf.org/doc/rfc7636/"
  },
  "text_modified": "2015-09-16T20:36:55Z"
}