OAuth Authorization Code With PKCE

Specify OAuth login for a public client (a SPA or a native app) using authorization code with PKCE. No implicit flow. No client secret in the app. PROVIDER [GOOGLE | GITHUB | A GENERIC OIDC] App type: [SPA | NATIVE] Redirect URI: [URL] Scopes: [LIST — MINIMAL] DELIVER 1) The authorize request: code challenge from a verifier stored in the session or a platform-safe place, state for CSRF, the exact parameters. 2) The code exchange on a server or the protected token endpoint the platform recommends. If the client is a SPA and the provider supports it, say where the exchange happens and why the verifier never becomes a secret in the repo. 3) How we bind the login to our user record (the stable subject id, not the email alone, and what we do when the email changes). 4) The state and nonce checks and the failure the user sees. 5) Token storage: httpOnly cookie for a web session we create, not the provider refresh token in localStorage. If a refresh token is unavoidable, say the constraint. Do not use the implicit grant. Do not log the authorization code.