pkce
AI security interview questions tagged pkce, across every topic.
2 questions · 1 unlocked for you
Concepts behind "pkce"
Explanations of the mechanisms these questions rely on.
Foundational
OAuth 2.0 and PKCEOAuth 2.0 is a framework for delegated authorization: a user lets an application access a resource on their behalf, with limited scopes, without sharing their password. The authorization code flow sends the user to the authorization server, returns a short-lived code, and exchanges it for tokens. PKCE binds code redemption to a per-flow verifier: someone who steals only the code cannot redeem it. This is not proof of an installed app's identity. Current best practice uses the code flow with PKCE for every client type. Identity & Access
Core
Signing In From a Mobile App: OAuth for Native AppsA mobile app cannot keep a client secret, so OAuth treats it as a public client. RFC 8252 sets the pattern: run the login in the system browser or a platform authentication session, never an embedded WebView; receive the code on a redirect the OS verifies, such as an App Link or universal link; and protect the code with PKCE using S256. RFC 9700 adds that public clients must use PKCE and that their refresh tokens must be rotated or bound to a key, which on a phone can live in secure hardware. Mobile SecuritySign in