This is the architecture I want to follow
I'm using a backend to exchange tokens with the authorization code, then send the tokens back to the frontend via set-cookie header.
Would PKCE be required for this case? I think it's unnecessary here since the client secrets can be safe in the Django server, just wanted a confirmation as I'm new to this realm.
Also, I'll be encrypting the state parameter in the front-end, and decrypting it in the backend probably using asymmetric keys.
Is there any security vulnerability in these approaches?
If PKCE is required, how could we share the code verifier between the client and the server?