Why can't the client server speak directly to an identity provider like Facebook in OAauth 2.0

Question

OAuth 2.0 used for authentication by Google makes sense given that the server and client both trust Google but not each other.

As I understand the authorization code is passed back to the server (in server side flow) as a URL parameter. To prevent security issues like the confused deputy, the authorization code is a one time use and the server can use the authorization code to obtain an access token and refresh token.

My question is why can't this process be simplified if Google (a trusted entity) directly sends the access token to the server (and not through the client)? This would eliminate the need for an authorization code. Google can be sure it's sending the access token to the right place because the client would have registered the redirect_uri with Google beforehand. It seems to be a general pattern that these protocols have the identity provider only send things to the server through the client.

Answer 1

While it would be possible, the process would be more complex and therefore a faulty implementation more likely.

For example it could work like this:

1. redirect to OAuth authentication endpoint, include a session identifier
2. user logs in
3. OAuth provider sends authentication token and session identifier to requesting server
4. user's session is linked with the authentication token
5. user is redirected to REDIRECT_URI

The session identifier is needed, because else an attacker with good timing could take over the authentication token. As you can see the session identifier is replacing the authentication token to identify the client in this example, which means that sending the token from server to server is just an additional step.

the client would have registered the redirect_uri with Google beforehand

The registration would make the system less flexible, because currently only the calling service needs to decide which OAuth provider to trust. By using registrations the relation has to be established on two sides.