1. Authorization flow with PKCE https://github.com/Anish407/OpenID-Connect---Authorization-flow-with-PKCE When a browser is involved in the communication, it is not safe to store the id and access tokens in the it. Browser is not considered to be safe. Everything you send to the browser is readable and can be extracted, manipulated, and potentially exploited. That's why authorization code flow was invented. Using that flow, tokens aren't sent in the redirect back to the client from the authorization endpoint. Instead, a code is sent. The code can then be used by the client to do a back channel request. That's a request done at the client level the browser doesn't know about. In this request, the code is exchanged for an access token at a token endpoint. When the client does the request to the token endpoint, it has to present its client ID and secret. If the OpenID scope is among the requested scopes, the token endpoint also sends the identity token ...
I jot down whatever I learn from different sources.Written for personal use. But anyone can learn.