CONTEXT
There is a SPA that uses Authorization Code Grant flow with PKCE to get info from an API all the info is highly sensitive
RESEARCH
Here is what I found of how Authorization Code Grant flow with PKCE works:
THE FLOW
v = code_verifier
$ = code_challenge
a = authorization_code
THE PURPOSE
In this article https://www.scottbrady91.com/oauth/client-authentication-vs-pkce said that PKCE is not enough and you need client authentication still
PKCE helps protect you against various code injection attacks, but PKCE does not replace client authentication.
and the purpose of PKCE is to ensure that all the requests come from the same client
With PKCE, you prove that the same application is swapping the code as the one who requested it.
WHAT I UNDERSTOOD
PKCE is just to ensure that all the requests come from the same client, but it doesn't care if the client is authorized or not
REMEMBER:
The SPA can't use the backend, so all requests are exposed all the time
I can't rely on SOP or CORS to block, you know that some clients like postman can overpass SOP and CORS
The info is very sensitive, so only authorized clients can get the info, for example:
https://authorized-third-party.com
must be able to get his info, buthttp://fake-third-party.com
must not be able to get the info
QUESTIONS
What will happen if someone authenticates using the SPA and get code_verifier (random string), code_challenge (hashed code verifier using SHA-256) and authorization code (or simply the token generated at the end of the grant flow) from the request by opening the web developer tools, Is he able to request the information in its own client using verifier, challenge and auth code to get the information?
What is the real purpose of Authorization Code Grant flow with PKCE?
Should include any additional grant flow? If so, which and how can I combine both?
if PKCE purpose is not caring if the client is authorized or not, How can avoid unauthorized clients to get the info?