authentication Shipped
What this lens looks for
Confirm public clients use OAuth 2.0 / OpenID Connect with PKCE; the deprecated Implicit flow (removed in OAuth 2.1) must not appear anywhere. Check flow selection per platform: native apps (iOS/Android/Windows) use Authorization Code + PKCE through the system browser (ASWebAuthenticationSession, Custom Tabs, WebAuthenticationBroker) and MUST NOT embed a WebView for auth, since the app can intercept credentials; SPAs use Authorization Code + PKCE, ideally a Backend-for-Frontend where the SPA never touches tokens and the BFF holds them server-side in HttpOnly cookies; server-to-server uses the Client Credentials flow. On session management, access tokens are short-lived (5-15 minutes); refresh token rotation must be in place so each use issues a new refresh token and invalidates the old one, with reuse of a revoked refresh token detected and the entire token family invalidated; absolute session timeouts are enforced server-side.
What its verifier checks
No Implicit flow is used by any client; public clients use Authorization Code + PKCE with a code_challenge; native apps authenticate via the system browser with no embedded WebView; SPAs use Authorization Code + PKCE (BFF holds tokens in HttpOnly cookies where applicable); server-to-server uses Client Credentials; access tokens expire within 5-15 minutes; refresh token rotation issues a new token and invalidates the prior one on each use; revoked-refresh-token reuse is detected and invalidates the whole token family; absolute session timeouts are enforced server-side.