tokens: ['OAuth', '', 'Authorization', 'code', 'flow', '', 'with', 'additional', 'security', 'enhancements', 'proposed', 'by', '', 'is', 'used', 'as', 'the', 'OpenID', 'Connect', 'flow', 'in', 'the', 'proposed', 'solution', 'The', 'MCPTT', 'Client', 'native', 'application', 'in', 'the', 'UE', 'is', 'a', 'public', 'client', 'incapable', 'of', 'maintaining', 'the', 'confidentiality', 'of', 'their', 'credentials', 'When', 'a', 'public', 'client', 'utilizes', 'the', 'Authorization', 'Code', 'Grant', 'to', 'authenticate', 'with', 'the', 'OIDC', 'server', 'they', 'are', 'susceptible', 'to', 'the', 'authorization', 'code', 'interception', 'attack', 'Once', 'the', 'user', 'ie', 'the', 'resource', 'owner', 'authenticates', 'the', 'OIDC', 'server', 'provides', 'MCPTT', 'Client', 'with', 'an', 'authorization', 'code', 'through', 'a', 'browser', 'redirect', 'HTTP', 'message', 'The', 'client', 'then', 'sends', 'the', 'authorization', 'code', 'to', 'the', 'OIDC', 'Server', 'and', 'gets', 'an', 'access', 'token', 'in', 'return', 'The', 'Redirection', 'URI', 'typically', 'uses', 'a', 'custom', 'URI', 'to', 'communicate', 'with', 'the', 'native', 'application', 'The', 'interface', 'between', 'the', 'browser', 'and', 'the', 'native', 'app', 'is', 'based', 'on', 'callbacks', 'handlers', 'This', 'path', 'is', 'unprotected', 'and', 'could', 'be', 'attacked', 'by', 'a', 'malicious', 'application', 'native', 'application', 'in', 'the', 'UE']