PKCE: The OAuth Extension You’re Probably Already Using (and Should Understand)

Why the Authorization Code flow wasn’t enough, and how a little cryptographic handshake fixed it.