pkce
Articles tagged with pkce.
OpenAM PKCE Bypass and JWKS SSRF (2026): Lessons for Keycloak OIDC Clients
OpenAM before 16.1.3 skipped PKCE on hybrid flows (CVE-2026-105119) and fetched unvalidated jwks_uri values (CVE-2026-105122). Here is the Keycloak checklist.
11 min readOAuth Redirect URI Parser Confusion: Why PKCE Does Not Save You
PKCE in OAuth does not protect an auth code sent to the wrong host. How URL parsers disagree on OAuth…
8 min readMCP Python SDK OAuth Flaw: Pin the Issuer on Keycloak
MCP OAuth flaw GHSA-qx49-fqc8-xw99: a malicious server could steal client secrets and PKCE verifiers from the MCP Python SDK. Upgrade,…
12 min read
Python Authentication: Login Pages Without Storing Passwords
Build a Python login page that never stores a password: Flask and Authlib with PKCE, Keycloak as the identity provider,…
8 min read
Keycloak Authentication in Astro
Add Keycloak login to an Astro site with OpenID Connect: the authorization code flow with PKCE, server-side sessions, protecting SSR…
11 min readOAuth for Mobile Apps: Best Practices with Keycloak
Learn mobile OAuth best practices with Keycloak including PKCE, secure token storage, refresh rotation, and biometric binding for iOS and…
11 min read
Secure React API Access Using Keycloak (OIDC + PKCE)
Learn how to secure React API access with Keycloak using OIDC Authorization Code Flow and PKCE for browser-based single-page applications.
5 min read
OAuth 2.1: What Changed and How Keycloak Implements It
Discover OAuth 2.1 changes including mandatory PKCE, deprecated implicit flow, and how Keycloak implements these security improvements since version 24.
4 min read
Keycloak: How To Create A PKCE Authorization Flow Client?
How to set up a PKCE authorization flow client in Keycloak: configure a public client with Standard flow, then enforce…
4 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.