OAuth 2.0 Authorization Code + PKCE
A vertical-time protocol trace for public SPA clients
Lesson 1 of 11
‹
Play
›
↺
−
Fit
+
1×
2×
Slow
Drag empty space to pan · drag any whole card to inspect routes · scroll to zoom
User
Browser
SPA Client
Authorization Server
Resource Server
time ↓
1
User
2
Browser
3
SPA Client
4
Authorization Server
5
Resource Server
!
Attacker