# PKCE enforcement with OAuth2.0

**URL:** <https://community.novulo.com/t/pkce-enforcement-with-oauth2-0/975>\
**Category:** \[Q&A\] General\
**Tags:** rest\
**Created:** [September 14, 2026, 2:23pm UTC](https://community.novulo.com/t/pkce-enforcement-with-oauth2-0/975 "2026-09-14T14:23:13Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![heppener\_anker](https://avatars.discourse-cdn.com/v4/letter/h/c89c15/32.png) [@heppener\_anker](https://community.novulo.com/u/heppener_anker)\
**Post date:** [September 14, 2026, 2:23pm UTC](https://community.novulo.com/t/pkce-enforcement-with-oauth2-0/975/1 "2026-09-14T14:23:13Z")

</div>

Hi

I have been following: [Novulo OAuth2.0 configuration and usage - Wiki - Novulo](https://community.novulo.com/t/novulo-oauth2-0-configuration-and-usage/560) and it works perfectly. We’ve got a public client working.

While testing, I wanted to confirm whether PKCE is enforced for public clients, since the RFC recommends it as best practice when no client\_secret is used. I tested the following:

1. I sent a code\_challenge and code\_challenge\_method=S256 in the /oauth2/authorize request.
2. I completed login normally and received the authorization code.
3. At /oauth2/token, I tried exchanging the code with:

- the correct code\_verifier. It succeeded, as expected
- a random/mismatched code\_verifier. It still succeeded
- no code\_verifier at all. It also still succeeded

So in all cases we received a valid access\_token, regardless of whether the verifier matched. This probably means the code\_challenge sent at the authorize step is currently accepted but not actually validated at the token step.

So my questions are:

- Is PKCE validation supported for public clients, and are we possibly missing a configuration step or component revision to enable it?
- If not currently supported, is PKCE enforcement on the roadmap for the OAuth2 Authorization Server component (M9939)?

Happy to share more details on our exact test setup if useful. Thanks!