Comment by paulddraper

Your comment doesn't explain what attack can be mitigated by redirect allowlist but not PKCE.