Lion Cipher Lab
Run the OAuth 2.0 Authorization Code flow with PKCE by hand
- Identity & Access Management
- Intermediate
- ~60 min
- Free · no account required
Why it matters
The authorization-code flow with PKCE is the default, recommended way to log a user into almost any modern app — every single-page app, every mobile app, and now (under OAuth 2.1) confidential web apps too. In the basics lab you watched it happen; here you drive it yourself, which is the difference between recognising the parts and being able to debug them at 2am when a login is broken. You will generate the verifier and challenge with your own hands, see the exact /authorize parameters, capture the code, trade it for real tokens at the /token endpoint, and watch the exchange FAIL the instant…
What you'll learn
- OAuth 2.0 authorization-code flow
- PKCE (RFC 7636)
- code_verifier and S256 code_challenge
- the /authorize and /token endpoints
- public vs confidential clients
- why state is still needed for CSRF
- decoding a JWT id_token
- running a real authorization server (Keycloak)
Steps in this lab
- The attack PKCE exists to stop
- Start a real authorization server: Keycloak in Docker
- Create a realm, a user, and a PUBLIC client that requires PKCE
- Generate the code_verifier and the S256 code_challenge
- Why S256, not plain — and why you still send state
- Hit /authorize in the browser and capture the code
- Exchange the code for tokens at /token
- Watch PKCE work: exchange again with the WRONG verifier
- Decode the id_token JWT to read the claims
- Public vs confidential, the pro move, and when NOT to hand-roll