GitHub Enhances Security with PKCE Support for OAuth and GitHub Apps
GitHub has rolled out Proof Key for Code Exchange (PKCE) support for OAuth and GitHub App authentication, marking a significant security upgrade. The implementation aligns with the OAuth 2.0 standard (RFC 7636) and is designed to protect authorization codes from interception attacks.
PKCE introduces an additional LAYER of security by requiring a code_verifier parameter during the token exchange process. While GitHub isn't mandating PKCE for all authentication flows, it strongly recommends adoption for GitHub Apps and OAuth apps. The device code flow and installation token flows remain unchanged.