Level up your Box knowledge with brand new learning paths on Box University. Visit training.box.com to get started

Box Status

Is Box support PKCE implementation?

Answered
Follow
New post
kony mobile

Team - In the /login request, passing code_challenge and code_challenge_method and getting code which is being used in the token request. If I am passing code_verifier in the token request then getting expected result i.e. getting access token  but if code_verifier is not present in token request still getting access token i.e. wrong. Our expectation is, token request should be failed.

0

Comments

3 comments

Date Votes
  • Official comment
    Alex Novotny

    Hi, 

    I'm not sure I fully understand your question. Can you try restating it in another way? 

    Thanks, 

    Alex, Box Developer Advocate

    Comment actions Permalink
  • kony mobile

    Our intention is to secure access token from the malicious user so we are trying to use PKCE. 

    So, In the /login request, passing code_challenge and code_challenge_method to get the code which is being used in subsequent call for token.

    My question here is, if I don't specify code_verifier along with code  in the token request, what should be the behavior?

     

    0
    Comment actions Permalink
  • Alex Novotny

    I think you are meaning to post this on the Dropbox forum and not the Box forum... I did a quick google and found this

    https://dropbox.tech/developers/pkce--what-and-why-

    0
    Comment actions Permalink

Please sign in to leave a comment.