2 / 8 Authentication: Sessions, JWT & OAuth

Someone Else's URL Scheme

Your iOS app starts a login in the system browser and receives the authorization code on a custom URL scheme. A malicious app registers the same scheme and receives the code first. Which mechanism stops that code from being redeemed?

A

The nonce claim in the ID token, which the app checks to reject a response it did not initiate itself

B

PKCE: the app sends a hash of a random verifier to start the flow and the verifier itself at exchange, so a code without the verifier is useless

C

The state parameter, which the app generates before the redirect and compares on return to prove the response belongs to the request it started

D

Shipping the client secret inside the app binary, so the token endpoint can authenticate the exchange and refuse any request from an app that cannot present it