#dev 2021-06-16

2021-06-16 UTC

aaronpk There's still a few different concerns with stealing refresh tokens, so adding the code verifier wouldn't solve any attacks where the attacker would also be able to steal that out of the app at the same time as stealing the refresh token