IAM and SSO · 20 due
OAuth 2.0 Security predicted recall 0%

What is the 'confidential client' vs 'public client' distinction in OAuth 2.0, and why does it matter for SSO security?

# PKCE flow (required for public clients) # 1. Client generates code_verifier (random string) code_verifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk" # 2. Client sends code_challenge (SHA-256 hash of verifier, base64url) code_challenge = "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM" GET /authorize?client_id=spa&code_challenge=...&code_challenge_method=S256 HTTP/1.1