For Authorization code grant flow, RFC says the authorization server will send back the code to the redirect_uri specified.

I believe it means the browser will recieve a URL like http://webapp/?code=xyz

Now, the code in the browser will send the code to the client app so that the client will ask, using the code, an access token to the autorization server

That's where my question comes in. I think that returning the code to the user-agent is not secure

What if it was only returned to the client so that it can process the code to obtain an access token ? Is is at all possible ?


We have several sides in OAuth2 authorization code grant exchange

  • OAuth Client - an application that want to be granted access
  • Authorization Server - entity managing access
  • Resource Owner (End User) with his user agent - person making decision to grant access (or not)

Now to initiate the flow Client captures Resource Owner's user agent and redirects it to Authorization server endpoint - passing scope of required access. The redirect is a mechanism to pass both scope of the request and actual, captured user to whom the request is addressed.

After the Resource Owner makes the decision it have to be passed back to the Client. OAuth2 uses second redirect for that and there are several benefits

  • The Resource Owner user agent (browser) is back on Client's site and can continue working with it
  • The Client can use cookies and other mechanism to confirm that the returning user is the same that one in initial redirect.
  • As to obtain token the Client need some secret information, the leaking of code to the user does not open it to abuse

With direct server-to-server call instead first two points would be hart to achieve - for very limited security gain.

  • I will read your answer again. I did not undertand everything. But you are saying in both case the Auth Server will give the code directly to the Client ? What would be the use of the redirect then ? What does the user-agent do when it's redirected anyway ? I'll still confused here. Resource owner receives the code or is it the client... I'm confused lol
    – tom johnes
    Nov 18 '19 at 15:34
  • From the end - the resource owner (usually) is the person that is the person that authorizes (or not) the access. The client is an application that want to get access. In redirect user agent receives some URL and opens it. The information contained in URL is know to all three parties (server sending redirect, user agent, target server) and it is trivial to modify user agent to capture the URL instead of sending it to the target server. I will try to clarify my answer but it may take some time.
    – AGrzes
    Nov 18 '19 at 18:11
  • This is so true. The three parties receive the token. I was wondering how to give another adress to the user-agent since I don't want the auth code to be known by it.
    – tom johnes
    Nov 19 '19 at 12:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.