Web Security · Senior · Question 42 of 75

According to the OAuth 2.0 Security BCP (RFC 9700), who should use PKCE?

1Only mobile apps
✓Correct answer: All clients, including confidential server-side ones
3Nobody, it was replaced by the implicit flow

Explanation

PKCE also protects confidential clients against code injection, so it's now recommended for every authorization code flow.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.