Authorization Code Flow

Welcome to the Authorization Code Flow lesson! This is the most secure and widely adopted OAuth2 flow, especially for web applications.

It's designed to protect sensitive credentials and is the go-to choice for clients that can keep a secret, known as confidential clients.

A confidential client is an application (like a traditional web server app) that can securely store a secret, such as a client_secret.

This flow relies on a secure, direct communication channel between your application's backend and the Authorization Server, keeping sensitive tokens away from the user's browser.

Recall the four key roles in OAuth2:

• Resource Owner: The user granting access.
• Client: Your application requesting access.
• Authorization Server: Verifies identity and issues tokens.
• Resource Server: Holds the protected data.

In this flow, they interact in a specific, multi-step dance.

It all starts when the Resource Owner (user) wants to log in or grant access to your Client application.

Your application redirects the user's browser to the Authorization Server's authorization endpoint, including several parameters:

• response_type=code (crucial!)
• client_id (your app's ID)
• redirect_uri (where to send the user back)
• scope (permissions requested)
• state (for security, explained later)

Once redirected to the Authorization Server, the user sees a consent screen.

This screen asks the user if they agree to grant your Client application the requested permissions (defined by scope).

The user can then choose to Approve or Deny the request.

If the user approves, the Authorization Server redirects the user's browser back to the redirect_uri you provided in Step 1.

This redirect URL now includes a one-time use authorization code and the state parameter you sent, for example:

This code is short-lived and doesn't grant direct access to resources.

This is where the magic happens! Your Client application's backend (server-side) receives the authorization code.

It then makes a direct, back-channel HTTP POST request to the Authorization Server's token endpoint.

This request includes the code, redirect_uri, client_id, and crucially, your client_secret to authenticate your application.

The Authorization Server validates the request, especially the client_secret and the code.

If everything is valid, it issues an access token and, optionally, a refresh token to your Client application's backend.

Your application can now use the access token to make requests to the Resource Server on behalf of the user.

The state parameter is a critical security measure against Cross-Site Request Forgery (CSRF) attacks.

Your Client should generate a unique, cryptographically random string for each authorization request and include it as the state parameter.

When the Authorization Server redirects back, it includes this same state. Your Client must then verify that the returned state matches the one it sent, ensuring the callback is legitimate.

The Authorization Code Flow is best suited for:

• Confidential Clients: Especially web server applications.
• Clients with a backend: Where the client_secret can be securely stored and used.
• Public Clients with PKCE: (Covered in a later lesson) Mobile apps and SPAs can use it with an extension called PKCE for enhanced security.

It's the most robust choice when security is paramount.

Consider the steps of the Authorization Code Flow. Which of these parameters are typically sent by the client to the Authorization Server's token endpoint during the token exchange step?

You've mastered the Authorization Code Flow!

• It's the most secure OAuth2 flow.
• Ideal for confidential clients (server-side apps).
• Uses a temporary authorization code to exchange for tokens.
• The token exchange happens securely via a back-channel (server-to-server).
• The state parameter protects against CSRF.

This flow forms the foundation for many secure authentication and authorization systems.