One of the really nice articles I came across while trying to understand the various grant types in Oauth2.0 was this. The author really has done a good job at explaining quite clearly what various grant types in an Oauth2.0 flow look like. I also followed a few more articles like this and this. Each one of them explaining well about the flows involved in the different grant types.
However, there is one thing that I am getting confused with & hence this post. Would love to understand what am I missing here.
In the Authorization Code Grant flow, after the Authorization Code is shared with the client (a web app page that the end user is accessing in their browser or a mobile app that the end user is accessing), the front end web page of this web application sends the Authorization Code to it's backend. The web app's backend (server side code) then exchanges this information (along with other info, like the client secret etc.) with the authorization server for an access token. Till here things are clear. (or please correct me if my understanding is not correct here).
Now the confusion is:
Does the web app's backend server send this access token back to it's front end & then the front end makes all subsequent calls, with this access token, to access the resources?
Is it that the access token is never really sent to the web app's front end & instead the front end code simply sends all resource access requests to it's backend which then fetches the resources, using the access token from the backend, & forwards it to the front end?