Authorization code flow faces PKCE enforcement decision in OAuth 2.1 draft
The goal is to determine whether an authorization server should treat the Proof Key for Code Exchange (PKCE) extension as a mandatory requirement for the authorization code flow when aligning with the OAuth 2.1 draft, which proposes to make PKCE compulsory for both public and confidential clients, while many existing OAuth 2.0 implementations still accept re