Security Basics

Currently Playing: OAuth is Broken Without This | Meet PKCE

If you're building a mobile app, single-page app (SPA), or browser-based tool that uses OAuth — PKCE is essential. PKCE (Proof Key for Code Exchange) is a powerful security upgrade to the OAuth 2.0 Authorization Code Flow. It protects users from authorization code interception attacks — especially when your app can't safely store a client secret. In this video, we break down: - Why traditional OAuth isn't safe for public clients - What PKCE is and how it solves the code interception problem - The step-by-step PKCE flow using real-world examples - Code samples and architecture walkthroughs - How tools like VS Code, Spotify, and Auth0 use PKCE today You’ll leave with a crystal-clear understanding of how PKCE works, where to use it, and why it’s now the default for secure OAuth flows in SPAs and mobile apps. 🔐 Watch this before building your next login system! ⏱️ Timestamps 0:00 – Intro: Why OAuth Needs PKCE for Public Clients 0:42 – Quick OAuth 2.0 Recap & What’s Broken 1:28 – What is PKCE? (Proof Key for Code Exchange) 4:29 – The Problem PKCE Solves (Code Interception) 4:52 – How the PKCE Flow Works (Step-by-Step) 5:52 – JavaScript Code Example of PKCE in Action 6:56 – Real-World Use Cases: Mobile, SPA, CLI 7:40 – Gmail Case Study: When PKCE is Optional 8:40 – The Future: OAuth 2.1, CAEP & Beyond https://www.linkedin.com/in/bytemonk/ https://www.youtube.com/playlist?list=PLJq-63ZRPdBt423WbyAD1YZO0Ljo1pzvY https://www.youtube.com/playlist?list=PLJq-63ZRPdBssWTtcUlbngD_O5HaxXu6k https://www.youtube.com/playlist?list=PLJq-63ZRPdBu38EjXRXzyPat3sYMHbIWU https://www.youtube.com/playlist?list=PLJq-63ZRPdBuo5zjv9bPNLIks4tfd0Pui https://www.youtube.com/playlist?list=PLJq-63ZRPdBsPWE24vdpmgeRFMRQyjvvj https://www.youtube.com/playlist?list=PLJq-63ZRPdBslxJd-ZT12BNBDqGZgFo58 AWS Certification: AWS Certified Cloud Practioner: https://youtu.be/wF1pldkQrOY AWS Certified Solution Architect Associate: https://youtu.be/GzomXNLFgkk AWS Certified Solution Architect Professional: https://youtu.be/KFZrBxSA9tI #PKCE #OAuth2 #WebSecurity #MobileSecurity #Bytemonk