I have used json webtokens to handle authentication for some hobby websites in the past. For my next site I would like to use OAuth2, to allow my site to be used with other services.
It seems that the OAuth2 authorization_code protocol adds some extra steps (state and the authorization code) in order to prevent a kind of replay attack where one client is tricked into using an access token issued to another client.
Is that the only purpose of issuing an authorisation code prior to token exchange? If I add information such as client_id and expiry time into a signed JWT and return this as the 'authorization_code', skipping the token exchange step, will I have lost any security? I am assuming that all communication is happening over https.