PKCE is the most obvious solution for OAuth clients. Tension: nonce is appropriate for OpenID Connect clients.

facef480-e476-4112-8b03-cc0f6c685345