OAuth2 Authorization Code + PKCE
Explain the OAuth2 authorization code flow with PKCE for a public SPA/mobile client. Why is PKCE needed?
Answers use simple, clear English.
Audio N/AQuick interview answer
User authenticates at the IdP; client receives an authorization code and exchanges it at the token endpoint with a code_verifier. PKCE stops code interception attacks on public clients that cannot hold a client secret. Prefer Auth Code+PKCE over implicit flow (deprecated).
Detailed answer
User authenticates at the IdP; client receives an authorization code and exchanges it at the token endpoint with a code_verifier. PKCE stops code interception attacks on public clients that cannot hold a client secret. Prefer Auth Code+PKCE over implicit flow (deprecated). Backend-for-frontend can still hold secrets; public SPAs should not.
Full explanation
Backend-for-frontend can still hold secrets; public SPAs should not.
Real example & use case
Mobile app uses Auth0/Entra ID Auth Code+PKCE to obtain short-lived access tokens.
Pros & cons
Pros: no embedded client secret. Cons: redirect URI hygiene and token storage still matter.