DeepFrontend
Learning Paths
Practice
System Design & DS
Design Studio
Data Structures Curriculum
Real-World Case Studies
Careers
Job Board
Resume Builder
Blog
Sign in
Search
⌘K
Go Pro
Loading compiler resources...
API Development Quiz Practice
Active Recall Drill Session
← Exit Session
Question 1 of 1
medium
API Development
In the Implement It Yourself PKCE example, why does the attacker's guessed code_verifier fail verification?
A
PKCE verification always fails randomly
B
The stored code_challenge is a SHA256 hash of the ORIGINAL code_verifier — only that exact original value, which never left the legitimate app's memory, produces a matching hash
C
The attacker's guess was too long
D
PKCE doesn't actually verify anything
Check Answer