A typical OAuth2 Authorization Code Flow scenario looks like this:

[![Typical flow diagram][1]][1]

What I'm not understanding is the purpose of the client secret in steps 6 and 7.  If the auth server is guaranteed to redirect back to the web app and send its authorization code there, how could an attacker get the authorization code (which is presumably the reason for the client secret)?

In addition, it seems that the PKCE extension does away with the need for the client secret, but reading [the RFC][2] for that I can't see any reason why it should.  Could somebody explain this for me?


  [1]: https://i.sstatic.net/rWasD.png
  [2]: https://tools.ietf.org/html/rfc7636