Web Security · Middle · Question 50 of 75
What problem does PKCE solve?
- ✓Correct answer: A stolen authorization code can't be exchanged for tokens without the secret
code_verifierthe client created - 2It removes the need for redirect URIs
- 3It encrypts the access token
Explanation
The client sends a hash (code_challenge) at the start and the original value at the token step. An attacker who only saw the code can't finish the flow.