The Redirect-Based Authorization Dance
OAuth 2.0 solves the problem of delegated access without sharing passwords. When a user logs into a third-party app (e.g., 'Sign in with GitHub'), the app redirects them to GitHub's authorization server. The user grants permission, and the server redirects back with an authorization code. The app exchanges this code for an access token, which grants temporary permission to act on the user's behalf.
This flow keeps the user's password away from the third-party app. Only the authorization server sees the password; the app sees only the token. If the app is compromised, tokens can be revoked without changing the user's password.
PKCE: Protecting the Exchange
Proof Key for Public Clients (PKCE) adds a cryptographic handshake to defend against interception attacks. Before redirecting to the authorization server, the public app generates a random challenge string and derives a code verifier. When exchanging the authorization code for a token, the app proves it still possesses the verifier, cryptographically tying the code to the initial request.
This prevents an attacker who intercepts the redirect URL from using the authorization code themselves. PKCE is now mandatory for public clients (mobile apps, single-page applications) and recommended for all OAuth deployments, as it costs little and neutralizes an entire attack surface.