title: Should I use PKCE for OpenID Connect with Native Desktop Application?
body: <p>I want to use OpenID Connect for my native windows and Linux desktop applications to authenticate my users.</p>
  <p>As stated in <a href="https://www.rfc-editor.org/rfc/rfc8252#section-7.3" rel="nofollow noreferrer">&quot;OAuth 2.0 for Native Apps&quot; Section 7.3 </a> I want to open a <strong>local TCP port to redirect</strong> from the Authentication Server to get the Authorization Code. I think there is no other option to use for native apps which work both for Windows and Linux.</p>
  <p>So the <strong>flow would be like:</strong></p>
  <ul>
  <li>Native app starts and shows login button</li>
  <li>When login button is pressed</li>
  </ul>
  <ul>
  <li>native apps opens a ephemeral, local port</li>
  <li>browser opens with login page of authentication provider (sending along the client id and secret, redirect URI and scope openid, response_type=code)</li>
  </ul>
  <ul>
  <li>After successful authentication of user in browser</li>
  </ul>
  <ul>
  <li>the authenication provider redirects to the redirect URI, which is the local open port</li>
  <li>the local port should display something like &quot;close browser now and go back to app&quot; to user</li>
  </ul>
  <ul>
  <li>Native application gets code from redirect and closes port</li>
  <li>Native application asks the token endpoint to get the identity token using the code</li>
  </ul>
  <ul>
  <li>validate the identity token using the signature</li>
  <li>will be able to get the details of the user out of that identity token</li>
  </ul>
  <p>My question now is <strong>do I need PKCE?</strong> I found <a href="https://web-in-security.blogspot.com/2017/01/pkce-what-cannot-be-protected.html" rel="nofollow noreferrer">this article</a> which states it does not bring any extra safety apart from making sure that when another app on the same device has registered the same <a href="https://www.rfc-editor.org/rfc/rfc8252#section-7.1" rel="nofollow noreferrer">Private-Use URI Scheme Redirect</a>.</p>
  <p><strong>Is my plan in any other way flawed or needs further improvements?</strong> I understand that the client id and secret can be seen as &quot;public&quot; because they ship with the software and could be reverse engineered. But my software will not be available on public web pages (hopefully) and only be given to trusted customers (which will all have different client id and secrets).</p>