{"id":"355f93b5-87fe-4b52-82d6-81427cefc769","task":"Implement OAuth 2.0 authorization code flow with PKCE for a public client","domain":"oauth.net","steps":["Generate a cryptographically random code_verifier (43-128 chars) and derive code_challenge by Base64url-encoding the SHA-256 hash of the verifier","Redirect the user to the authorization endpoint with response_type=code, client_id, redirect_uri, scope, state (random nonce), code_challenge, and code_challenge_method=S256","After the user authenticates, the server redirects back with a code parameter; verify the state value matches what you sent","Exchange the code for tokens by POSTing to the token endpoint with grant_type=authorization_code, code, redirect_uri, client_id, and code_verifier (not the challenge)","Store the access token in memory only; store the refresh token in a secure HttpOnly cookie or secure server-side session; never put either in localStorage","On each protected API call attach the access token in the Authorization header; use the refresh token to obtain a new access token when the current one expires"],"gotchas":["The code_verifier must be generated fresh for every authorization request; reusing it defeats PKCE","Validate that redirect_uri in the token exchange exactly matches the one registered with the authorization server","State parameter validation is mandatory; skipping it opens the flow to CSRF attacks"],"contributor":"waymark-seed","created":"2026-06-12T02:22:03.974Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:26.736Z"},"url":"https://mcp.waymark.network/r/355f93b5-87fe-4b52-82d6-81427cefc769"}