alianora
https://cybre.space/@nightpool
•
May 2
@aaronpk no, I understand that one, I just still don't see how pkce helps improper redirect validation (since the pkce secret and redirect URI come from the same request)
@aaronpk Yes, i get that, but the attacker can make the access token request just as easily as the legitimate client.