GitHub Fortifies Security: PKCE Now Mandatory for OAuth & GitHub Apps

GitHub just slammed the door on authorization loopholes. The platform now enforces PKCE (Proof Key for Code Exchange) for all OAuth integrations and GitHub Apps—no more half-measures in the fight against token interception attacks.

Why this matters: Developers can finally stop pretending their side projects are 'too small' to be targeted. Meanwhile, Wall Street still thinks '2FA' is a type of crypto token.

The silent upgrade: No fanfare, no blog post confetti—just a quiet rollout that actually improves security. Unlike certain blockchain 'innovations,' this one doesn't require a whitepaper to explain its utility.

Bottom line: GitHub's move proves real security evolves faster than crypto hype cycles. Now if only they could fix 'npm left-pad' with the same efficiency.

GitHub Introduces PKCE Support

GitHub has announced the integration of Proof Key for Code Exchange (PKCE) into its OAuth and GitHub App authentication processes. This MOVE aims to bolster security by ensuring that only the initiating client can exchange authorization codes for access tokens, according to GitHub.

Understanding PKCE

PKCE, a security extension of OAuth 2.0 standard (RFC 7636), addresses vulnerabilities by adding an additional LAYER of security during the code exchange process. Applications can implement PKCE by including code_challenge_method and code_challenge parameters during user authorization flows. The corresponding code_verifier parameter is then required when exchanging the code for an access token. Notably, only the S256 code challenge method is supported.

Current Requirements and Exemptions

At this time, GitHub is not mandating the use of PKCE for any authentication flows, as it does not differentiate between public and confidential clients. However, it is recommended for both GitHub Apps and OAuth apps during authorization code flows. Notably, the device code FLOW and installation token flows remain unaffected by PKCE requirements.

A few applications previously misusing PKCE have been temporarily exempted from enforcement to prevent disruptions. GitHub has contacted these developers to assist in updating their applications to properly implement PKCE.

Impact on Developers

This change underscores GitHub's commitment to enhancing security for its users. While the transition may require adjustments for some developers, the long-term benefits of improved security and user trust are expected to outweigh initial implementation challenges.

• github
• pkce
• oauth
• security