Subject: [OAUTH-WG] Aligning PKCE requirements within the OAuth Security BCP

From: Mike Jones <[email-masked]>
Date: Wed, 6 May 2020 21:04:01 +0000

As is being discussed in the thread "[OAUTH-WG] OAuth 2.1 - require PKCE?", https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15#section-2.1.1 has inconsistent requirements for PKCE support between clients and servers.  Per the first paragraph, clients must either use PKCE or use the OpenID Connect nonce to prevent authorization code injection.  Whereas the fourth paragraph says "Authorization servers MUST support PKCE [RFC7636].".  This imposes a requirement on servers that isn't present for corresponding clients.  (I missed this internal discrepancy within the specification when I did my review.)

I therefore request that the fourth paragraph by change to read: "OAuth Servers MUST support PKCE [RFC7636] unless they are only used for OpenID Connect Authentication Requests", making the requirements on clients and servers parallel.  That way PKCE will still be there unless you don't need it.  (And it still could be there if the server implementer chooses to have it in all cases, but that should be their call.)

                                                       Thank you,
                                                       -- Mike

---

From: Sascha Preibisch <[email-masked]>
Date: Wed, 6 May 2020 14:37:22 -0700

The document is called "...Best Current Practice ..." and includes
recommendations. Could it be sufficient to say "Authorization servers
support PKCE" in section 2.1.1?  I believe MUST and other such terms
may not necessarily belong into such document.

Regards,
Sascha

On Wed, 6 May 2020 at 14:04, Mike Jones
<Michael.Jones=[email-masked]> wrote:
>
> As is being discussed in the thread “[OAUTH-WG] OAuth 2.1 - require PKCE?”, https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15#section-2.1..1 has inconsistent requirements for PKCE support between clients and servers.  Per the first paragraph, clients must either use PKCE or use the OpenID Connect nonce to prevent authorization code injection.  Whereas the fourth paragraph says “Authorization servers MUST support PKCE [RFC7636].”.  This imposes a requirement on servers that isn’t present for corresponding clients.  (I missed this internal discrepancy within the specification when I did my review.)
>
>
>
> I therefore request that the fourth paragraph by change to read: “OAuth Servers MUST support PKCE [RFC7636] unless they are only used for OpenID Connect Authentication Requests”, making the requirements on clients and servers parallel.  That way PKCE will still be there unless you don’t need it.  (And it still could be there if the server implementer chooses to have it in all cases, but that should be their call.)
>
>
>
>                                                        Thank you,
>
>                                                        -- Mike
>
>
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Jared Jennings <[email-masked]>
Date: Sun, 10 May 2020 15:21:33 -0500

As a clarifying question, you are saying "Servers must support" and not
"Servers must require clients to use PKCE".

-Jared
Skype:jaredljennings
Signal:+1 816.730.9540
WhatsApp: +1 816.678.4152

On Wed, May 6, 2020 at 4:04 PM Mike Jones <Michael.Jones=
[email-masked]> wrote:

> As is being discussed in the thread “[OAUTH-WG] OAuth 2.1 - require
> PKCE?”,
> https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15#section-2.1..1
> <https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15#section-2.1.1>
> has inconsistent requirements for PKCE support between clients and
> servers.  Per the first paragraph, clients must either use PKCE or use the
> OpenID Connect nonce to prevent authorization code injection.  Whereas the
> fourth paragraph says “*Authorization servers MUST support PKCE [RFC7636]*.”.
> This imposes a requirement on servers that isn’t present for corresponding
> clients.  (I missed this internal discrepancy within the specification when
> I did my review.)
>
>
>
> I therefore request that the fourth paragraph by change to read: “*OAuth
> Servers MUST support PKCE [RFC7636] unless they are only used for OpenID
> Connect Authentication Requests*”, making the requirements on clients and
> servers parallel.  That way PKCE will still be there unless you don’t need
> it.  (And it still could be there if the server implementer chooses to have
> it in all cases, but that should be their call.)
>
>
>
>                                                        Thank you,
>
>                                                        -- Mike
>
>