This question is in the context of the OAuth 2.0 Authorization Framework.
Consider a web application that is backed by a first-party API but relies on a third-party authorization server for SSO.
The first-party API tries to get an access token from the third-party authorization server with the given authorization code and the predefined client secret. If successful, it then tries to get the user resource on the third-party resource server. Then it responds to the request from the index page on the CDN with a session cookie for that user.
Now, in my experience, the redirect URI has been a resource on the first-party API, which redirects the user again, back to the index page on the CDN. But for this question, the first-party API wants the index page to pass it the authorization code through AJAX.
Is this a secure workflow? If not, how is it a result of using a CDN resource for the redirect URI?