RFC7636 · Доказательство ключа для обмена кодом в OAuth (PKCE)

{
  "id": "RFC7636",
  "number": 7636,
  "title_en": "Proof Key for Code Exchange by OAuth Public Clients",
  "title_ru": "Доказательство ключа для обмена кодом в OAuth (PKCE)",
  "summary_ru": "Защищает код авторизации OAuth от перехвата: клиент связывает запрос авторизации с последующим обменом кода посредством одноразового проверочного значения. Механизм особенно важен для общедоступных клиентов, но современная практика рекомендует его шире.",
  "purpose_ru": "",
  "use_ru": "",
  "full_translation_path": "",
  "full_translation_checked_at": "",
  "full_translation_source_sha256": "",
  "architect_note_ru": "Используйте метод S256 и не рассматривайте PKCE как замену проверке redirect URI, state/nonce и другим мерам профиля авторизации.",
  "topics_ru": [
    "OAuth 2.0",
    "PKCE",
    "защита кода"
  ],
  "translation_state": "reviewed",
  "verification_level": "editorial_reviewed",
  "verification_level_ru": "Проверенная редакционная выжимка",
  "verification_note_ru": "",
  "abstract_en": "OAuth 2.0 public clients utilizing the Authorization Code Grant are susceptible to the authorization code interception attack. This specification describes the attack as well as a technique to mitigate against the threat through the use of Proof Key for Code Exchange (PKCE, pronounced \"pixy\").",
  "authors": [
    "N. Sakimura",
    "J. Bradley",
    "N. Agarwal"
  ],
  "organizations": [],
  "publication_date": "2015-09-01",
  "current_status": "PROPOSED STANDARD",
  "current_status_ru": "Предлагаемый стандарт",
  "publication_status": "PROPOSED STANDARD",
  "publication_status_ru": "Предлагаемый стандарт",
  "lifecycle": "active",
  "lifecycle_ru": "Действующий",
  "stream": "IETF",
  "stream_ru": "IETF",
  "area": "sec",
  "area_ru": "Безопасность",
  "working_group": "oauth",
  "source_draft": "draft-ietf-oauth-spop-15",
  "page_count": 20,
  "doi": "10.17487/RFC7636",
  "keywords": [
    "smart phones",
    "apps",
    "XARA",
    "authorization",
    "custom scheme",
    "intent",
    "man-in-the-middle",
    "eavesdropping",
    "user agent swap",
    "spop",
    "pop",
    "openid",
    "connect",
    "pkce",
    "pixie"
  ],
  "formats": [
    "TXT",
    "HTML"
  ],
  "relations": {
    "obsoletes": [],
    "obsoleted_by": [],
    "updates": [],
    "updated_by": [],
    "is_also": [],
    "see_also": []
  },
  "links": {
    "info": "https://www.rfc-editor.org/info/rfc7636/",
    "html": "https://www.rfc-editor.org/rfc/rfc7636.html",
    "txt": "https://www.rfc-editor.org/rfc/rfc7636.txt",
    "datatracker": "https://datatracker.ietf.org/doc/rfc7636/"
  }
}