{
  "version": 1,
  "title": "OAuth PKCE: one code, two token requests",
  "format": "custom",
  "canvasSize": [
    1200,
    720
  ],
  "watermark": true,
  "objects": [
    {
      "type": "text",
      "text": "OAuth PKCE: a stolen code is not enough",
      "x": 45,
      "y": 24,
      "fontSize": 43,
      "color": "#292d32",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "Fictional browser task board connects a calendar",
      "x": 46,
      "y": 91,
      "fontSize": 27,
      "color": "#59675e",
      "fontFamily": "sans"
    },
    {
      "type": "pen",
      "points": [
        [
          45,
          140
        ],
        [
          314,
          141
        ],
        [
          601,
          139
        ],
        [
          867,
          141
        ],
        [
          1153,
          140
        ]
      ],
      "color": "#bac9c1",
      "width": 3,
      "smooth": false
    },
    {
      "type": "pen",
      "points": [
        [
          42,
          172
        ],
        [
          366,
          173
        ],
        [
          366,
          283
        ],
        [
          42,
          282
        ],
        [
          42,
          172
        ]
      ],
      "color": "#285caa",
      "width": 3,
      "smooth": false
    },
    {
      "type": "text",
      "text": "1  BROWSER APP",
      "x": 61,
      "y": 188,
      "fontSize": 27,
      "color": "#285caa",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "create + keep verifier V",
      "x": 61,
      "y": 230,
      "fontSize": 23,
      "color": "#292d32",
      "fontFamily": "sans"
    },
    {
      "type": "arrow",
      "points": [
        [
          370,
          225
        ],
        [
          424,
          225
        ]
      ],
      "color": "#285caa",
      "width": 4,
      "smooth": false
    },
    {
      "type": "pen",
      "points": [
        [
          438,
          172
        ],
        [
          762,
          173
        ],
        [
          762,
          283
        ],
        [
          438,
          282
        ],
        [
          438,
          172
        ]
      ],
      "color": "#285caa",
      "width": 3,
      "smooth": false
    },
    {
      "type": "text",
      "text": "2  AUTH REQUEST",
      "x": 456,
      "y": 188,
      "fontSize": 26,
      "color": "#285caa",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "send S256 challenge H(V)",
      "x": 456,
      "y": 230,
      "fontSize": 22,
      "color": "#292d32",
      "fontFamily": "sans"
    },
    {
      "type": "arrow",
      "points": [
        [
          766,
          225
        ],
        [
          820,
          225
        ]
      ],
      "color": "#285caa",
      "width": 4,
      "smooth": false
    },
    {
      "type": "pen",
      "points": [
        [
          832,
          172
        ],
        [
          1158,
          173
        ],
        [
          1158,
          283
        ],
        [
          832,
          282
        ],
        [
          832,
          172
        ]
      ],
      "color": "#285caa",
      "width": 3,
      "smooth": false
    },
    {
      "type": "text",
      "text": "3  AUTH SERVER",
      "x": 851,
      "y": 188,
      "fontSize": 26,
      "color": "#285caa",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "bind H(V) to code C",
      "x": 851,
      "y": 230,
      "fontSize": 23,
      "color": "#292d32",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "After consent: redirect brings code C back",
      "x": 45,
      "y": 322,
      "fontSize": 26,
      "color": "#59675e",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "LEGITIMATE APP",
      "x": 45,
      "y": 365,
      "fontSize": 22,
      "color": "#287355",
      "fontFamily": "sans"
    },
    {
      "type": "pen",
      "points": [
        [
          42,
          396
        ],
        [
          366,
          397
        ],
        [
          366,
          496
        ],
        [
          42,
          495
        ],
        [
          42,
          396
        ]
      ],
      "color": "#287355",
      "width": 3,
      "smooth": false
    },
    {
      "type": "text",
      "text": "send C + V",
      "x": 61,
      "y": 412,
      "fontSize": 29,
      "color": "#292d32",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "saved V from this request",
      "x": 61,
      "y": 454,
      "fontSize": 21,
      "color": "#59675e",
      "fontFamily": "sans"
    },
    {
      "type": "arrow",
      "points": [
        [
          370,
          446
        ],
        [
          424,
          446
        ]
      ],
      "color": "#287355",
      "width": 4,
      "smooth": false
    },
    {
      "type": "pen",
      "points": [
        [
          438,
          396
        ],
        [
          762,
          397
        ],
        [
          762,
          496
        ],
        [
          438,
          495
        ],
        [
          438,
          396
        ]
      ],
      "color": "#287355",
      "width": 3,
      "smooth": false
    },
    {
      "type": "text",
      "text": "token endpoint",
      "x": 456,
      "y": 411,
      "fontSize": 28,
      "color": "#292d32",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "H(V) matches stored H(V)",
      "x": 456,
      "y": 454,
      "fontSize": 21,
      "color": "#59675e",
      "fontFamily": "sans"
    },
    {
      "type": "arrow",
      "points": [
        [
          766,
          446
        ],
        [
          820,
          446
        ]
      ],
      "color": "#287355",
      "width": 4,
      "smooth": false
    },
    {
      "type": "pen",
      "points": [
        [
          832,
          396
        ],
        [
          1158,
          397
        ],
        [
          1158,
          496
        ],
        [
          832,
          495
        ],
        [
          832,
          396
        ]
      ],
      "color": "#287355",
      "width": 3,
      "smooth": false
    },
    {
      "type": "text",
      "text": "TOKEN",
      "x": 851,
      "y": 411,
      "fontSize": 34,
      "color": "#287355",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "after other checks",
      "x": 851,
      "y": 454,
      "fontSize": 22,
      "color": "#59675e",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "INTERCEPTED CODE",
      "x": 45,
      "y": 509,
      "fontSize": 22,
      "color": "#a34438",
      "fontFamily": "sans"
    },
    {
      "type": "pen",
      "points": [
        [
          42,
          539
        ],
        [
          366,
          540
        ],
        [
          366,
          632
        ],
        [
          42,
          631
        ],
        [
          42,
          539
        ]
      ],
      "color": "#a34438",
      "width": 3,
      "smooth": false
    },
    {
      "type": "text",
      "text": "send C alone",
      "x": 61,
      "y": 555,
      "fontSize": 29,
      "color": "#292d32",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "no verifier V",
      "x": 61,
      "y": 594,
      "fontSize": 22,
      "color": "#59675e",
      "fontFamily": "sans"
    },
    {
      "type": "arrow",
      "points": [
        [
          370,
          584
        ],
        [
          424,
          584
        ]
      ],
      "color": "#a34438",
      "width": 4,
      "smooth": false
    },
    {
      "type": "pen",
      "points": [
        [
          438,
          539
        ],
        [
          762,
          540
        ],
        [
          762,
          632
        ],
        [
          438,
          631
        ],
        [
          438,
          539
        ]
      ],
      "color": "#a34438",
      "width": 3,
      "smooth": false
    },
    {
      "type": "text",
      "text": "check fails",
      "x": 456,
      "y": 555,
      "fontSize": 29,
      "color": "#292d32",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "matching V is missing",
      "x": 456,
      "y": 594,
      "fontSize": 22,
      "color": "#59675e",
      "fontFamily": "sans"
    },
    {
      "type": "arrow",
      "points": [
        [
          766,
          584
        ],
        [
          820,
          584
        ]
      ],
      "color": "#a34438",
      "width": 4,
      "smooth": false
    },
    {
      "type": "pen",
      "points": [
        [
          832,
          539
        ],
        [
          1158,
          540
        ],
        [
          1158,
          632
        ],
        [
          832,
          631
        ],
        [
          832,
          539
        ]
      ],
      "color": "#a34438",
      "width": 3,
      "smooth": false
    },
    {
      "type": "text",
      "text": "NO TOKEN",
      "x": 851,
      "y": 555,
      "fontSize": 31,
      "color": "#a34438",
      "fontFamily": "sans"
    },
    {
      "type": "text",
      "text": "invalid_grant",
      "x": 851,
      "y": 594,
      "fontSize": 22,
      "color": "#59675e",
      "fontFamily": "sans"
    }
  ]
}