Investigate whether user agent token is checked in authorization code flow

[louischan-oursky]

1. Attacker generates code challenge
2. Attacker install malicious app in user, registering a deep link URL same as an existing client
3. User navigate to authorize endpoint with code challenge generated by Attacker
4. Attacker's app receive authorization code
5. Attacker can exchange authorization code using code verifier

According to OAuth threat model, the security of user device is not in our scope.

[louischan-oursky]

We can suggest the developer in the documentation and in the portal to use universal links in iOS and app links in Android. The developer must provide a verified domain to enable them. On the other hand, custom URI scheme requires no verification at all so it has a higher risk of being intercepted by a malicious application installed on the device of the user.

[louischan-oursky]

authgear/docs#18