OAUTH-PKCE Practice Test

OAUTH-PKCE practice test: what's covered

• Authorization Code
• PKCE
• OIDC Tokens
• Redirect URI
• Discovery
• Refresh Token Rotation

Free OAUTH-PKCE sample questions

1. A React single-page app exchanges an authorization code at the token endpoint and receives invalid_grant after users return from the identity provider. Browser logs show the app regenerated local flow state after a reload. Which root cause best fits the failure?

   • A. The token endpoint requires the original code_verifier that matches the authorization request challenge
   • B. The client must add a long-lived client secret into the browser JavaScript bundle
   • C. The identity provider must disable TLS inspection for every public client callback
   • D. The app should switch from authorization code to the deprecated implicit response type
   Show answer

   Correct: A. PKCE binds the authorization request to the token request through the code_verifier and code_challenge. If the app loses that verifier, the code exchange should fail. A public SPA cannot protect a client secret, TLS inspection does not repair lost verifier state, and implicit flow avoids the wrong problem while weakening the design.

2. A mobile team asks which PKCE properties should be enforced before approving their OAuth rollout. Which TWO checks are most important for a modern public client?

   • A. Use S256 code_challenge_method instead of accepting plain by default
   • B. Generate a high-entropy per-transaction code_verifier and keep it only until code exchange
   • C. Store one shared code_verifier in app configuration for every login attempt
   • D. Skip state because PKCE automatically proves the user's browser session
   • E. Allow authorization codes to be exchanged multiple times for resilience
   Show answer

   Correct: A and B. A strong PKCE implementation uses a fresh high-entropy verifier and the S256 transformed challenge. A static verifier is replayable, state still protects front-channel session binding, and authorization codes should be short lived and single use. These controls reduce code interception and code injection risk.

3. During review, an authorization server accepts redirect_uri=https://app.example.com/callback/anything for a client registered with https://app.example.com/callback. Which finding should be raised first?

   • A. The server should perform exact redirect URI matching or a tightly registered equivalent
   • B. The server should permit any path under the same domain because DNS already proves ownership
   • C. The client should move the access token into the URL fragment to avoid code theft
   • D. The callback should be converted to HTTP because browser redirects are easier to debug
   Show answer

   Correct: A. Loose redirect matching can turn an OAuth client into an authorization-code delivery tool for attacker-controlled endpoints. Exact matching or strictly registered redirect variants are the expected control. Domain-only trust, token fragments, and HTTP callbacks do not address open redirect or callback substitution risk.

4. A web app uses OIDC for login and OAuth for API access. Which TWO request values should be stored server-side or in protected transient client state and verified when the user returns?

   • A. state value that binds the callback to the initiated browser session
   • B. nonce value that is later checked against the ID token when OIDC is used
   • C. scope string copied from a marketing page without server-side validation
   • D. access token value placed in the redirect URI query string for observability
   • E. client_secret value placed in localStorage for faster token endpoint calls
   Show answer

   Correct: A and B. State protects the authorization response from CSRF and request confusion, while nonce protects an OIDC authentication response from replay or token substitution. Scope still needs validation but is not the front-channel correlation secret. Access tokens and client secrets should not be exposed in callback URLs or browser storage.

5. A legacy training portal still uses response_type=token and receives access tokens directly through the browser front channel. Which modernization path should be recommended?

   • A. Move to authorization code flow with PKCE and keep tokens out of the front-channel redirect
   • B. Keep implicit flow but make access tokens valid for several days to reduce login prompts
   • C. Replace OAuth with resource owner password credentials for all employees and students
   • D. Add more scopes to the token request so authorization failures are easier to observe
   Show answer

   Correct: A. The implicit response type exposes tokens through the browser front channel and is deprecated by current OAuth security guidance. Authorization code with PKCE gives the client a back-channel token exchange and verifier binding. Longer token lifetime, password grants, and wider scopes increase risk instead of fixing the flow.

Last updated: 2026-10-19

OAUTH-PKCE practice test FAQ