Public Client Profile (SPA / Mobile)

PKCE Authorization Flow (RFC 7636)

Demonstrates a pure client-side Single Page Application with zero server secrets. The browser cryptographically generates and verifies its identity.

Public Client ID: dandelion_public_spa_01

Cryptographic Parameters (Web Crypto API)

The browser dynamically derives a SHA-256 code challenge from a high-entropy random verifier.

1. code_verifier

Private to Browser

32 cryptographically random bytes generated via window.crypto.getRandomValues. Stored in sessionStorage for <30 seconds.

Generating verifier...

2. code_challenge (S256)

Safe to Send over Network

One-way cryptographic hash: Base64URL(SHA-256(verifier)). Transmitted in URL parameters during initial authorization.

Generating challenge...

Next Step: Authorization Delegation

GET https://supabase-sveltekit-playground.pages.dev/api/v1/oauth/authorize?response_type=code&client_id=dandelion_public_spa_01&redirect_uri=...&code_challenge=...&code_challenge_method=S256

Public Client Security Analysis

RFC 7636 Threat Mitigation

No Hardcoded Secrets

There is no CLIENT_SECRET anywhere in the bundle. Decompiling the JavaScript or viewing network requests yields zero privileged server keys.

Code Interception Defense

Even if a malicious actor steals the code from browser history or URL logs, they cannot exchange it without the original browser's code_verifier.

Strict Single-Use

The moment the legitimate browser exchanges the code, Viselta burns the authorization code. Subsequent attempts trigger a security alert.