New answers tagged

1

Okta and the client app are using RSA as the underlying verification mechanism. Okta signs its JWTs using the private half of an RSA keypair and publishes the public half of the keypair at that /keys endpoint. The JWT contains the ID of the key that was used to sign it, so the client app can then retrieve the public key and use it to verify that the JWT ...


1

Taking you to be asking two questions, what does pkce guard against, and how is client_id being random offering any protection to you if people can just lift it out of your source code, this is my understanding: why does pkce even exist: the whole reason for pkce is due to the nature that mutliple smartphone apps can register themselves to be "handlers&...


Top 50 recent answers are included