Mobile applications are distributed public clients; embedded shared secrets cannot remain confidential. PKCE binds authorization-code exchange to the initiating flow.
Evaluation approach
Keep the authorization request and verifier in the same flow. Do not mix simultaneous sign-ins or accounts.
Application example
Open two sign-in attempts and verify that each callback reaches its own request. Reject stale or mismatched codes safely.
Limits and considerations
PKCE alone does not fix insecure redirect URIs or missing authentication checks.
What happens with two sign-ins?
One global variable can attach the wrong return to a valid flow. Keep request contexts separate and accept only matching callbacks.
Checks and decisions
- Preserve flow binding
- Generate strong verifiers
- Test concurrent sign-ins
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.