PKCE & choosing a flow
P55.oauth-flows.02 · Audience: guest, it-ml, language-pro · Prerequisites: Why OAuth: delegation, not authentication
The authorization code can be stolen on mobile and single-page apps — PKCE closes that gap by binding the code to the client that started the flow. This module builds the S256 PKCE derivation (a SHA-256 kata, ties P52), then steps back to the judgement call: which OAuth flow fits which app, and why implicit is deprecated.
Ask the mentor about this module
Ask a question about this content. The mentor explains and grounds its answer in what you are studying; asking is recorded as a learning signal, not a grade.
Keeping your files on this device
Off by default. The mentor always gets your file; this only decides whether your own copy stays here. Copies live in this browser only - they do not follow you to another device, and clearing site data removes them.
Rung 1 — PKCE: bind the code to the client
Loading exercise…
Interview rung — choosing an OAuth flow (free-form)
Loading exercise…
My notes on this module
Loading your notes...