A public client is an application that cannot store client credentials safely. Mobile apps and single-page web apps are exposed because attackers can inspect the application and recover embedded secrets. section 13.1 section 13.2
This creates a risk in the authorization code flow: an attacker who intercepts an authorization code may use recovered client credentials to obtain an access token and reach protected resources. section 13.1
Protect public clients with these practices:
- Use PKCE. Generate a random code verifier, derive a code challenge with a one-way hash such as SHA-256, and present the verifier when exchanging the authorization code. section 13.5 section 13.1
- Pair refresh tokens with PKCE, keep scopes limited, rotate refresh tokens after use, set expiration times, and revoke suspicious tokens. section 13.5 section 13.2
- Use TLS/SSL for communication among the client, authorization server, and resource server. section 13.2
