PKCE
PKCE (Proof Key for Code Exchange, RFC 7636) hardens the OAuth 2.0 authorization-code flow: the client commits to a one-time secret up front, so an intercepted authorization code is useless without it.
Encryption and sign-in
The attack PKCE kills: authorization codes travel through browser redirects, and anything that can observe the redirect — a malicious app registered for the same URL scheme, a leaky log — could historically exchange the stolen code for tokens. With PKCE the client sends a hash (the code challenge, S256) when authorization starts and must present the preimage (the code verifier) when redeeming the code. Interceptors hold a code they cannot spend.
Originally designed for mobile apps that cannot keep a client secret, PKCE is now the recommended default for every OAuth client, and the OAuth 2.1 draft requires it. Ciphera’s sign-in supports PKCE with S256, and the plain method is rejected.