Ok so I get the benefit that PKCE provides. Without it, the attacker knows your client_secret and by registering the same URL scheme as your application on mobile, can intercept the redirect with the auth code, and then use it along with your client_id and client_secret to receive an access token to the user's resources.
However with PKCE, the only thing that the attacker now needs is your client_id. They can generate their own PKCE. On intercepting the redirect, they can now use the auth code received along with the client_id and code_verifier (since they generated the PKCE themselves) to get the access token.
So my question is:
Is the only thing that prevents an attacker from doing this, is that they still need to direct the user to the identity provider to authenticate, and in doing so, the user would see that the identity provider is requesting them to supply permission to your app, which is different to the (malicious) app they came from? Or is there another blocker?
