In OAuth 2.0 Authorization Code Flow (Grant Type), is it recommended (or is it maybe even a best practice) to send an authentication request (e.g. a login-request form) to the Resource Owner (by the Authorization Server), even if the Resource Owner has already an active session on the Authorization Server, when obtaining an Authorization Code for the first time for a certain Client?

In other words, is it recommended to kill/destroy a currently active session first, if there's one? Or is it not important at all?

1 Answer 1


Actually you won't know from the client side whether the resource owner has an active web session on the authorization server or not, and it's not the client's matter.

That's however up to the authorization to decide what to do, for instance:

  • Authenticate if the resource owner is not logged in
  • Grant immediate access without logging in again if the resource owner has already logged in, or reauthenticate him (for instance if he logged in more than 7 days ago) by killing or updating the session. Reauthentication can also consist in requiring a second factor (SMS OTP...)
  • Make the resource owner authorize some scopes he has not approved yet
  • Or even ask him to approve new CGUs
  • Etc

In a nutshell, it's the authorization server's matter to decide what to do (i.e. applying an authentication and authorization policy), not the client's.

If the resource owner is already logged in, has approved the requested scope, etc. then the server will redirect to the client directly with an authorization code. In this case a blank page will shortly appear, the URL will change swiftly (redirects) before the resource owner is redirected to the client. This is how SSO (Single Sign-On) works.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .