OAuth PKCE Support for SitePublish (8.0.5)
FortiWeb now supports Proof Key for Code Exchange (PKCE) for OAuth 2.0 configurations. PKCE is a security extension designed to protect the authorization code flow, particularly for public clients like mobile or single-page applications where client secrets cannot be safely stored.
Why PKCE is Important
In a standard OAuth flow, a static client secret is used to exchange an authorization code for a token. PKCE replaces or augments this by using a dynamic, per-request code verifier and code challenge.
-
Mitigates Code Interception: Prevents attackers from intercepting the authorization code and using it to obtain access tokens.
-
Prevents Man-in-the-Middle (MITM) Attacks: Ensures that even if an attacker intercepts the code, they cannot exchange it without the original code verifier.
-
Stops App Impersonation: Validates that the client requesting the token is the same one that initiated the authorization request.
Key Capabilities
-
Dynamic Security: Uses a unique verifier for every single request instead of a static secret.
-
Modern Deployment Ready: Essential for securing modern web and mobile apps that interact with OAuth providers.
Configuration
A new PKCE Enforcement option is available within the OAuth Server settings. This option is only available when the OAuth Mode is set to either Client or Both. The feature is set to disable by default.
