PKCE, started in authorize, posted in token

PKCE stands for Proof Key for Code Exchange. It protects the OAuth authorization code so that even if someone steals the code from the redirect, they still cannot exchange it for a token.

The client first creates a random secret:

code_verifier = random_secret_123

Then it hashes that secret:

code_challenge = SHA256(code_verifier)

The authorization request sends only the challenge:

/authorize?
  client_id=abc&
  redirect_uri=http://127.0.0.1:5000/callback&
  code_challenge=HASHED_VALUE&
  code_challenge_method=S256

After login, Mantis redirects back with:

code=AUTH_CODE_123

Then the CLI calls /token with both the authorization code and the original secret:

POST /token

code=AUTH_CODE_123
code_verifier=random_secret_123

Mantis checks:

SHA256(code_verifier)
        ==
stored code_challenge

If they match, it issues the token.

So if an attacker somehow steals only:

AUTH_CODE_123

they still cannot get the token because they don't have:

code_verifier