What is PKCE and when is it required in OAuth2 flows in NestJS?

Q: What is PKCE and when is it required in OAuth2 flows in NestJS?

// PKCE flow: // 1. Client generates: code_verifier = random 43-128 character string // 2. Client computes: code_challenge = base64url(sha256(code_verifier)) // 3. Authorization request includes: code_challenge + code_challenge_method=S256 // 4. Authorization server stores the code_challenge with the authorization code // 5. Token request includes: authorization_code + code_verifier // 6. Server verifies: sha256(code_verifier) === stored code_challenge // If an attacker intercepts the code, they cannot exchange it without the verifier // NestJS strategy — enable PKCE for public client support super({ clientID: 'your-client-id', callbackURL: '/auth/callback', pkce: true, // enables PKCE state: true, // CSRF protection }) // When PKCE is NOT needed: // - Server-side web apps with a confidential client that stores client_secret securely // When PKCE IS required: // - SPAs (no server to store client_secret) // - Mobile/desktop apps (replaces the now-deprecated implicit flow) // - Any public OAuth client PKCE prevents authorization code injection — an intercepted code is useless without the code_verifier. Required for SPAs and mobile apps — these are public clients that cannot securely store a client_secret. S256 method — code_challenge = BASE64URL(SHA256(ASCII(code_verifier))); always use S256, not plain. state parameter prevents CSRF attacks — always include it alongside PKCE. OAuth 2.1 requires PKCE for all authorization code flows — treat it as mandatory for all new implementations.

Difficulty: 5/10

OAuth2, PKCE, NestJS Auth

PKCE (Proof Key for Code Exchange) prevents authorization code interception attacks by binding the code to a verifier known only to the client. It is required for public clients (SPAs, mobile apps) that cannot securely store a client secret. As of OAuth 2.1, PKCE is recommended for all authorization code flows regardless of client type.

PKCE flow steps and NestJS strategy configuration

PKCE security benefits and requirements:

1
PKCE prevents authorization code injection — an intercepted code is useless without the code_verifier.
2
Required for SPAs and mobile apps — these are public clients that cannot securely store a client_secret.
3
S256 method — code_challenge = BASE64URL(SHA256(ASCII(code_verifier))); always use S256, not plain.
4
state parameter prevents CSRF attacks — always include it alongside PKCE.
5
OAuth 2.1 requires PKCE for all authorization code flows — treat it as mandatory for all new implementations.

Scenario Questions

0-2 years experience

2-5 years experience

1Our NestJS API calls an external service using the Authorization Code flow with PKCE, and suddenly token exchanges are failing. Walk me through how you'd troubleshoot the problem.

What is PKCE and when is it required in OAuth2 flows in NestJS?

Scenario Questions

Follow-up Questions