{
  "version": 1,
  "title": "OAuth PKCE: phone layout",
  "format": "custom",
  "canvasSize": [
    720,
    1300
  ],
  "watermark": true,
  "objects": [
    {
      "type": "text",
      "text": "OAuth PKCE",
      "x": 31,
      "y": 24,
      "fontSize": 49,
      "color": "#292d32",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "Why a stolen code alone fails",
      "x": 31,
      "y": 92,
      "fontSize": 29,
      "color": "#59675e",
      "fontFamily": "sans"
    },
    {
      "type": "pen",
      "points": [
        [
          30,
          148
        ],
        [
          222,
          149
        ],
        [
          462,
          147
        ],
        [
          690,
          149
        ]
      ],
      "color": "#bac9c1",
      "width": 3,
      "smooth": false
    },
    {
      "type": "pen",
      "points": [
        [
          38,
          185
        ],
        [
          683,
          186
        ],
        [
          683,
          289
        ],
        [
          38,
          288
        ],
        [
          38,
          185
        ]
      ],
      "color": "#285caa",
      "width": 3,
      "smooth": false
    },
    {
      "type": "text",
      "text": "1  Browser app creates V",
      "x": 57,
      "y": 202,
      "fontSize": 31,
      "color": "#285caa",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "keeps this random verifier",
      "x": 57,
      "y": 249,
      "fontSize": 25,
      "color": "#59675e",
      "fontFamily": "sans"
    },
    {
      "type": "arrow",
      "points": [
        [
          358,
          293
        ],
        [
          358,
          336
        ]
      ],
      "color": "#285caa",
      "width": 4,
      "smooth": false
    },
    {
      "type": "pen",
      "points": [
        [
          38,
          350
        ],
        [
          683,
          351
        ],
        [
          683,
          453
        ],
        [
          38,
          452
        ],
        [
          38,
          350
        ]
      ],
      "color": "#285caa",
      "width": 3,
      "smooth": false
    },
    {
      "type": "text",
      "text": "2  Send S256 challenge H(V)",
      "x": 57,
      "y": 368,
      "fontSize": 29,
      "color": "#285caa",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "not the verifier itself",
      "x": 57,
      "y": 411,
      "fontSize": 25,
      "color": "#59675e",
      "fontFamily": "sans"
    },
    {
      "type": "arrow",
      "points": [
        [
          358,
          457
        ],
        [
          358,
          500
        ]
      ],
      "color": "#285caa",
      "width": 4,
      "smooth": false
    },
    {
      "type": "pen",
      "points": [
        [
          38,
          515
        ],
        [
          683,
          516
        ],
        [
          683,
          619
        ],
        [
          38,
          618
        ],
        [
          38,
          515
        ]
      ],
      "color": "#285caa",
      "width": 3,
      "smooth": false
    },
    {
      "type": "text",
      "text": "3  Server issues code C",
      "x": 57,
      "y": 532,
      "fontSize": 30,
      "color": "#285caa",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "binds C to stored H(V)",
      "x": 57,
      "y": 576,
      "fontSize": 25,
      "color": "#59675e",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "After consent: callback returns C",
      "x": 31,
      "y": 666,
      "fontSize": 27,
      "color": "#59675e",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "LEGITIMATE APP",
      "x": 31,
      "y": 726,
      "fontSize": 27,
      "color": "#287355",
      "fontFamily": "sans"
    },
    {
      "type": "pen",
      "points": [
        [
          38,
          779
        ],
        [
          683,
          780
        ],
        [
          683,
          883
        ],
        [
          38,
          882
        ],
        [
          38,
          779
        ]
      ],
      "color": "#287355",
      "width": 3,
      "smooth": false
    },
    {
      "type": "text",
      "text": "C + V  →  challenge matches",
      "x": 57,
      "y": 798,
      "fontSize": 27,
      "color": "#292d32",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "token after other checks",
      "x": 57,
      "y": 844,
      "fontSize": 25,
      "color": "#59675e",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "INTERCEPTED CODE",
      "x": 31,
      "y": 928,
      "fontSize": 27,
      "color": "#a34438",
      "fontFamily": "sans"
    },
    {
      "type": "pen",
      "points": [
        [
          38,
          981
        ],
        [
          683,
          982
        ],
        [
          683,
          1085
        ],
        [
          38,
          1084
        ],
        [
          38,
          981
        ]
      ],
      "color": "#a34438",
      "width": 3,
      "smooth": false
    },
    {
      "type": "text",
      "text": "C alone  →  no matching V",
      "x": 57,
      "y": 1000,
      "fontSize": 27,
      "color": "#292d32",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "rejected: no token",
      "x": 57,
      "y": 1045,
      "fontSize": 25,
      "color": "#59675e",
      "fontFamily": "sans"
    },
    {
      "type": "pen",
      "points": [
        [
          30,
          1122
        ],
        [
          220,
          1123
        ],
        [
          455,
          1121
        ],
        [
          690,
          1123
        ]
      ],
      "color": "#bac9c1",
      "width": 3,
      "smooth": false
    },
    {
      "type": "text",
      "text": "PKCE protects this code exchange.",
      "x": 31,
      "y": 1142,
      "fontSize": 25,
      "color": "#59675e",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "It cannot protect a leaked verifier.",
      "x": 31,
      "y": 1182,
      "fontSize": 25,
      "color": "#59675e",
      "fontFamily": "sans"
    }
  ]
}