I've run into this docs when I was studying some SSO concepts;
This grant adds the concept of a code_verifier to the Authorization Code Grant. When the Client asks for an Authorization Code it generates a code_verifier and its transformed value called code_challenge. The code_challenge and a code_challenge_method are sent along with the request. When the Client wants to exchange the Authorization Code for an Access Token, it also sends along the code_verifier. The Authorization Server transforms this and if it matches the originally sent code_challenge, it returns an Access Token.
And here is the flow;
The part that I did not quite get is how the PKCE way is secure as the interceptor still be able to intercept the
code_verifier as much as he could intercept the
auth code. I believe I'm missing a point but not able to figure out what it is.