PT-AM-CPE Practice Exam Questions | PingAM

In PingAM 8.0.2, the recommended and most secure flow for "Public Clients"—such as Single Page Applications (SPAs) written in JavaScript—is the Authorization Code Grant Flow with PKCE (Proof Key for Code Exchange).

Historically, theImplicit Grant Flow(Option B) was used for browser-based apps because they could not securely store a client_secret. However, the Implicit flow is now considered legacy and insecure due to the risk of access token leakage in the browser history or via referrer headers. TheResource Owner Password Credentials Grant(Option C) is also discouraged as it requires the application to handle user credentials directly, violating the core principle of delegated authorization.Client Credentials(Option D) is reserved strictly for machine-to-machine communication where no user is involved.

TheAuthorization Code Grant with PKCEaddresses the security limitations of public clients by replacing the static client_secret with a dynamically generated "code verifier" and "code challenge." The process works as follows:

Challenge Generation: The JavaScript app creates a cryptographically strong random string (Verifier) and transforms it (Challenge).

Authorization Request: The app sends the challenge to PingAM.21

Code Exchange: After user login, AM returns an authorization code. The app then sends the codeandthe original verifier to the token endpoint.

Verification: AM verifies that the verifier matches the initial challenge before issuing the Access Token.

This flow ensures that even if an attacker intercepts the authorization code, they cannot exchange it for a token without the original verifier, which never left the browser's execution context. PingAM 8.0.2 fully supports this flow and provides specific configuration options in the OAuth2 Provider settings to enforce PKCE for all public clients.