According to RFC 8252, as specified in section 6, the native apps must implement PKCE.

> Public native app clients MUST implement the Proof Key for Code
> Exchange (PKCE [RFC7636]) extension to OAuth, and authorization
> servers MUST support PKCE for such clients, for the reasons detailed
> in Section 8.1.

Do we still need the client to support PKCE if the authorization happens inside the ASWebAuthenticationSession (iOS 12.0+) in IOS and Chrome Auth Tabs in Android?

As per the ASWebAuthenticationSession docs:

> The session passes this URL back to the app through a completion handler. ASWebAuthenticationSession > ensures that only the calling app’s session receives the authentication callback, even when more than > one app registers the same callback URL scheme.

For the Chrome Auth Tabs: [0][1]

> A dedicated callback adds a layer of security and eliminates the need for Activity intents.

• [0] https://developer.chrome.com/blog/android-auth-tab
• [1] https://developer.chrome.com/docs/android/custom-tabs/guide-auth-tab#why_auth_tab