I’m really struggling to wrap my head around this. I have a hypothetical flow, which includes 3 entities: The user/browser, AuthServer, client/App. This flow makes use authorisation code flow with PKCE. Here are the steps:

1. User clicks sign in
2. client/app generates code challenge and verifier. Redirects user to AuthServer
3. user follows redirect to AuthServer including the code challenge. The AuthServer stores this for later validation.
4. Authserver responds with Login prompt
5. User authenticates successfully
6. Authserver sends back Authcode to user browser via redirect to client
7. User browser sends AuthCode to Client/App
8. Client/ App trades this code with AuthServer for ID token, it uses the verifier from earlier, plus client secret.
9. Client/App sends ID token to user and establishes a session

Now for the attack scenario: Say that the user is an employee at a company, that uses a webproxy, and this webproxy intercepts and terminates, and stores all TLS traffic going between it. And a privileged admin had access to this proxy and had malicious intent – what would stop this admin from replaying the request in step 6, and basically hijacking the authentication and stealing the resulting token? I don’t see how PKCE would help here, since that is just verifying the client in this case, and the client is still correct.