From 55c9eb08f1ae51f744b9d16f5abb64789653d71f Mon Sep 17 00:00:00 2001 From: Fabi Date: Thu, 1 Feb 2024 08:59:53 +0100 Subject: [PATCH] docs: add missing word (#7324) Co-authored-by: Livio Spring --- docs/docs/guides/integrate/authmethods/_pkce.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/docs/guides/integrate/authmethods/_pkce.mdx b/docs/docs/guides/integrate/authmethods/_pkce.mdx index d2bb2fd90..708eecc01 100644 --- a/docs/docs/guides/integrate/authmethods/_pkce.mdx +++ b/docs/docs/guides/integrate/authmethods/_pkce.mdx @@ -19,7 +19,7 @@ on /authorize with at least the following parameters: We recommend always using two additional parameters `state` and `nonce`. The former enables you to transfer a state through the authentication process. The latter is used to bind the client session with the id_token and to mitigate replay attacks. -PKCE stands for Proof Key for Code Exchange. So other than "normal" code exchange, the does not authenticate using +PKCE stands for Proof Key for Code Exchange. So other than "normal" code exchange, the PKCE does not authenticate using client_id and client_secret but an additional code. You will have to generate a random string, hash it and send this hash on the authorization_endpoint. On the token_endpoint you will then send the plain string for the authorization to compute the hash as well and to verify it's correct. In order to do so you're required to send the following two parameters as well: