Welcome to the new Box Support website. Check out all the details here on what’s changed.

Box Status

Is Box support PKCE implementation?

Answered
Follow
New post
kony mobile

Team - In the /login request, passing code_challenge and code_challenge_method and getting code which is being used in the token request. If I am passing code_verifier in the token request then getting expected result i.e. getting access token  but if code_verifier is not present in token request still getting access token i.e. wrong. Our expectation is, token request should be failed.

0

Comments

3 comments

Date Votes
  • Official comment
    Alex Novotny

    Hi, 

    I'm not sure I fully understand your question. Can you try restating it in another way? 

    Thanks, 

    Alex, Box Developer Advocate

    Comment actions Permalink
  • kony mobile

    Our intention is to secure access token from the malicious user so we are trying to use PKCE. 

    So, In the /login request, passing code_challenge and code_challenge_method to get the code which is being used in subsequent call for token.

    My question here is, if I don't specify code_verifier along with code  in the token request, what should be the behavior?

     

    0
    Comment actions Permalink
  • Alex Novotny

    I think you are meaning to post this on the Dropbox forum and not the Box forum... I did a quick google and found this

    https://dropbox.tech/developers/pkce--what-and-why-

    0
    Comment actions Permalink

Please sign in to leave a comment.