title: Which OAuth flow do I use and where do I store the token in the case of a (Android/iOS) WebView hybrid App?
body: <p>I understand that the current best practice is to use PKCE with Public Clients:</p>
  
  <blockquote>
    <p>Note: Previously, it was recommended that browser-based apps use the "Implicit" flow, which returns an access token immediately and does not have a token exchange step. In the time since the spec was originally written, the industry best practice has changed to recommend that the authorization code flow be used without the client secret. This provides more opportunities to create a secure flow, such as using the PKCE extension.</p>
  </blockquote>
  
  <p>But I am confused as to whether a Android/iOS WebView is a Public Client. 
  To be clear: it's a hybrid app. So I have access to some native functions. Among others the keystore. But the main app consist of just html pages rendered by javascript embedded in the WebView.</p>
  
  <p>Is a WebView vulnerable to XSS attacks for example? I am a bit confused by all this.</p>