alianora
https://cybre.space/@nightpool
•
May 2
@aaronpk Yep, but in that case the attacker controls the redirect uri right? how can the attacker control the redirect uri without also controlling the pkce secret?
@aaronpk sure, totally down for that! really just trying to understand the benefit that PKCE brings to the table. it's certainly doesn't authenticate the client—it doesn't prevent misuse of the client's identity, for phishing, or misuse of the client's privileges, for the common practice of giving "in-house" clients certain features that normal clients don't get. so what does it do?