Why does Authorization Code flow need the authorization code?

Question

I've implemented Auth Code flow with PKCE on my server, but I'm still not entirely clear on why I'm doing it. I've read through the IETF documentation and I get flashes of what seems like understanding but it always seems to fade.

The nearest I can tell at the moment is that an attacker could have access to server info (via leaking HTTP logs it seems they are saying) but not client info, and thus when you add the code verifier and code challenge you're cutting that out. But then, if you're not acting as a third-party provider atm (and the new guidance seems to include people who aren't) what's the authorization code for and how does that make things better than with Implict Flow?

I'm sure that's ridiculously simplistic. Anything that could help me understand is very welcome :).

Answer 1

I suppose that this artictle should explain the most of your doubts.

https://medium.com/securing/what-is-going-on-with-oauth-2-0-and-why-you-should-not-use-it-for-authentication-5f47597b2611

Shortly speaking if you use implicit flow you are vulnerable to token leakage through URL (because URLs are logged into HTTP server logs) or token injection (where client is not able to check if the sender of the token is the legitimate token issuer).

Including code removes access token from the query string (so the token leakage vulnerability), because, to get the access token, you need to make additional backend request to Authorization Server (AS) which you already know is legitimate. To secure more, you should use it with PKCE to ensure that noone have stolen the code PKCE is verified by Authorization Server and only if is valid AS will return access token to the client.

So in summary, token is sent only in backend. Token issuer (AS) is validating if client is legitimate checking the code_verifier (PCKE). Token is provided only as a response for a request to legitimate AS. Having this both sides are secured.