Configuration: Missing PKCE¶

Identifier: missing_pkce

Scanner(s) Support¶

Description¶

OAuth public clients should use Proof Key for Code Exchange (PKCE) to bind authorization codes to the client instance that initiated the flow.

How we test: We inspect OAuth authorization code flows for missing or weak code_challenge and code_verifier handling, then verify whether authorization codes can be exchanged without a valid PKCE proof.

References:

• https://datatracker.ietf.org/doc/html/rfc7636
• https://datatracker.ietf.org/doc/html/rfc8252
• https://cheatsheetseries.owasp.org/cheatsheets/OAuth2_Cheat_Sheet.html

Configuration¶

Example¶

Example configuration:

---
security_tests:
  missing_pkce:
    skip: false

Reference¶

skip¶

Type : boolean

Skip the test if true.