Brock Allen
https://twitter.com/BrockLAllen
•
Feb 25
Arguably, tho, PKCE and putting a client secret into a SPA are orthogonal. It's conflating two things that work differently. Poor devs can't understand those differences.
The error should be "we see you sent a client secret and an Origin header. is your client a SPA?"
The error should be "we see you sent a client secret and an Origin header. is your client a SPA?"
