PKCE
Proof Key for Code Exchange (PKCE) is a security extension mechanism in OAuth 2.1 that uses a paired code_verifier and code_challenge to prevent authorization codes from being intercepted and misused during transmission.
Core Facts
MCP's permission model draws on the OAuth 2.0 authorization code flow, requiring explicit user authorization for tool invocation.
PKCE is a security extension in OAuth 2.1 designed for public clients, where the client submits a hash of the code verifier and must include the original verifier when exchanging for a token, making it impossible to redeem the token even if the authorization code is intercepted.
Timeline (last 90 days)
OAuth 2.0 provides mechanisms such as authorization code, PKCE, and Token Exchange (RFC 8693) to express that user A authorizes application B to access resource C on their behalf.
PKCE is a security extension in OAuth 2.1 designed for public clients, where the client submits a hash of the code verifier and must include the original verifier when exchanging for a token, making it impossible to redeem the token even if the authorization code is intercepted.
The authentication scheme recommended by the official MCP specification is OAuth 2.1 with PKCE.
OAuth 2.1 is a security-hardened version of OAuth 2.0 that mandates the use of PKCE and deprecates several insecure authorization flows.
OAuth 2.1 is a security-hardened version of the OAuth 2.0 authorization framework that mandates the use of PKCE to prevent authorization code interception attacks.
Some providers mandate PKCE (Proof Key for Code Exchange), while others treat it as optional.
PKCE is an important security enhancement in OAuth 2.1 compared to 2.0, defending against authorization code interception attacks through a paired verification mechanism of code_verifier and code_challenge.
MCP authorization mandates the use of PKCE (Proof Key for Code Exchange) to prevent authorization codes from being intercepted and exploited.
OAuth 2.1 mandates the use of PKCE (Proof Key for Code Exchange) to prevent authorization code interception attacks.
The OAuth 2.1 draft upgrades PKCE from optional to mandatory and prohibits implicit grants and resource owner password credential grants.
3 more timeline events
All Facts (13)
MCP's permission model draws on the OAuth 2.0 authorization code flow, requiring explicit user authorization for tool invocation.
75%VerifiedPKCE is a security extension in OAuth 2.1 designed for public clients, where the client submits a hash of the code verifier and must include the original verifier when exchanging for a token, making it impossible to redeem the token even if the authorization code is intercepted.
65%UnverifiedThe authentication scheme recommended by the official MCP specification is OAuth 2.1 with PKCE.
60%UnverifiedOAuth 2.1 mandates the use of PKCE (Proof Key for Code Exchange) to prevent authorization code interception attacks.
60%UnverifiedOAuth 2.0 provides mechanisms such as authorization code, PKCE, and Token Exchange (RFC 8693) to express that user A authorizes application B to access resource C on their behalf.
50%UnverifiedOAuth 2.1 is a security-hardened version of OAuth 2.0 that mandates the use of PKCE and deprecates several insecure authorization flows.
50%UnverifiedOAuth 2.1 is a security-hardened version of the OAuth 2.0 authorization framework that mandates the use of PKCE to prevent authorization code interception attacks.
50%UnverifiedSome providers mandate PKCE (Proof Key for Code Exchange), while others treat it as optional.
50%UnverifiedPKCE is an important security enhancement in OAuth 2.1 compared to 2.0, defending against authorization code interception attacks through a paired verification mechanism of code_verifier and code_challenge.
50%UnverifiedMCP authorization mandates the use of PKCE (Proof Key for Code Exchange) to prevent authorization codes from being intercepted and exploited.
50%UnverifiedThe OAuth 2.1 draft upgrades PKCE from optional to mandatory and prohibits implicit grants and resource owner password credential grants.
50%UnverifiedRemote MCP Servers are required to implement the OAuth 2.1 authentication flow, which mandates the use of PKCE to prevent authorization code interception attacks and disables implicit grants.
50%UnverifiedPKCE（Proof Key for Code Exchange）扩展通过生成随机 code_verifier 并验证其哈希值，可防止 Authorization Code 被劫持后滥用
50%