PKCE solves this problem by adding an extra step to the authorization code flow, where a code verifier is generated and passed along with the authorization code.