If a have a mobile that is authorized against my server using PKCE, which allows it to get a access_token
and a refresh_token
, to what extent should I trust that the app can use the refresh_token
from now on to get the access_token
? Surely the same concerns that led the standard to invent PKCE are at play here?
I am asking because while I was playing around with a Ruby library for Auth2, I discovered that this is OK to do, which perplexed me. Shouldn't this particular use case just ban refresh_tokens?
EDIT: Not sure if this will turn out to be the answer, but perhaps we assume here that (given a TLS connection), the refresh_token was sent back to the app securely and as long as the app is talking to the server directly we are good?