Visualizing the OAuth Flow and Why PKCE is Needed

[souvikghosh]

Great Video! Can you please now create a video where you actually demo how PKCE can save me.

[_dinesh]

But they did not explain how PKCE can secure this. (That was the reason I came to this video. The problem was pretty apparent.)

[vukkumsp]

Fun explanation if need for PKCE (though not the PKCE flow itself explained)

[mj]

imagine when App1 ordered the CODE, he also 'WHISPER' a secret(generated inside App1) to the waitress, and in the next step, exchanging the KEY using the CODE, that secret is required and will be validated on the Auth server. that's loosely what PKCE about.

[abhaysoni]

one minute does not the code flow requires client secret too. even though the other app got code how was it able to exchange the code without client secret

[phyoewaipaing]

Plz allow captains for this video if possible

[johndee]

I still don't get it. PKCE seems to say "the OS is compromised, here is a half baked solution". My thoughts are, if the OS is compromised, there are NO SOLUTIONS -ZERO. I just don't get this. It seams like a scam to get me to use corporate products. Anyway, maybe I'm crazy, but I say this is non-sense. I still have no understanding how if the OS is even potentially compromised, how any data can be secure? Thanks for making the video though! Maybe I'm slightly less confused....

[GheorgheUngureanu-ltix]

This video is confusing because it does not explain how HTTPS protects client-server connections from network attacks.

[vadimemelin]

It describes why does PKCE exist but doesn't really describe how does it work :(

[victoro]

You didnt actually demonstrate PKCE hence you got a few thumbs down

[johnfernandes]

Just stick to a workflow!!! it is easier. Very complicate understanding