In a standard OAuth auth code Grant flow, user is redirected to authorization server page where he provides consent to allow the requesting app to perform some actions on his behalf, after which a browser redirects the user to a redirect URI with auth code. Application then exchanges this code with authorization server to get an Access token..

Consider a scenario where user has already given consent or consent is somehow implicit (i.e., user is not required to interact with the authorization server consent page).. in this case, is it acceptable to use an http client with redirection disabled as the user agent instead of browser and capture the Location header of the redirection response from the authorization server ?

1 Answer 1


Yes, this is fine, as long as the request is done over HTTPS. From a security perspective there's no difference between having your browser do it and having a different application do it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .