Who initiates an authorization code flow?

Question

I'd like to understand OAuth 2.0 in more detail and especially the authorization code flow. This might be nit-picking but according to RFC6749 the client initiates the flow.

(A) The client initiates the flow by directing the resource owner's user-agent to the authorization endpoint.

But isn't it really the resource owner who initiates the flow by clicking a button like Connect with service xyz or Import photos from abc on the client application site when requesting authorization?

I mean it's this button click that sends out a HTTP GET originating from the resource owners machine/IP, right?

GET https://www.auth-server.com/oauth2/authorize?

client_id=18f4ad63-01fa-41ae-b632-092a8f5d340b&
redirect_uri=https://www.awesome-printservice.com/callback&
scope=openid photos.read
response_type=code&
response_mode=query&
nonce=ugasq9v1bq&

Answer 1

Consider the example of signing into your site (https://example.net) via your Google account.

In this case, you [and, by extension, your digital "user agent": Firefox or Chrome] are the "resource owner"; ExampleNET is the "client" (and also the "relying party").

The client, ExampleNET, initiates the flow by directing you, the resource owner, to emit that HTTP request you described.

Sounds weird? Look closer at that request.

See the nonce field? That had to be prepared by the client. More significantly (though missing from your example), in the same vein is the state field: also prepared by the client as they prepare to initiate the flow by [re]directing the resource owner to that big URL.

Now, they may or may not have "warmed the flow up" by pre-initializing the nonce (which, if they're using, they should be recording to check it against later), or by quickly generating it when the resource owner expresses intent to use that flow (by e.g., loading the Login page), and they may have done this in response to activity from you which clearly signaled intent to start that flow (such as e.g. clicking the Sign In Via Google link...)

but they're still the ones initiating the flow by giving you the (potentially ephemeral) necessaries to take the—from the resource owner's point-of-view—"first" step of the login flow. That's why the client is described as initiating it here.