رمز التفويض + PKCE

في هذا الدرس

follow the flow used by web, mobile, and single-page apps.

الموضوعات المخطط لها

• The client sends the user's browser to the authorization server to log in and approve.
• The server returns a short-lived authorization code to the client's redirect URL.
• The client swaps the code for tokens at the token endpoint.
• PKCE: the client invents a secret (code_verifier), sends its hash (code_challenge) first, then proves it with the verifier. A stolen code is then useless.
• Use this flow whenever a user logs in; current guidance recommends PKCE for all clients. The implicit grant and the password grant are not for new systems.