Bumping this as a community I assist is requesting support for PKCE.
Prior to being asked about it, I hadn’t yet seen anything about this, but looking through documentation for it it seems the primary driver for this is native apps and SPAs:
Native apps
- Cannot securely store a Client Secret. Decompiling the app will reveal the Client Secret, which is bound to the app and is the same for all users and devices
- May make use of a custom URL scheme to capture redirects (e.g., MyApp://) potentially allowing malicious applications to receive an Authorization Code from your Authorization Server
Single-page apps
- Cannot securely store a Client Secret because their entire source is available to the browser
Neither of which is applicable to this situation; it’s the Discourse server that holds the secret.
