System Design · Middle · Question 15 of 75
Which OAuth flow is recommended for SPAs and mobile apps?
- ✓Correct answer: Authorization Code with PKCE
- 2Implicit Flow with the token in the URL
- 3Password Grant with the password in the client
Explanation
A public client can't keep a secret. PKCE binds the authorization request and the code exchange with a one-time verifier/challenge pair, protecting against code interception. Implicit and Password Grant are considered deprecated and insecure.