Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
In OAuth, when the user authorizes the client the client gets a authorization code, the client then exchanges this for a token that is used to access the resource.
Why do we need to do this extra exchange of authzcode for the access token? Couldn't just the Authzcode be used directly to get a resource? What extra security does this exchange bring?
Separating the autzcode and the token allows de-coupling authentication and session handling. Advantages include the possibility of using multiple authentication services without adapting the session handling code and detecting misuse by malicious or compromised providers after legitimate user authentication.
For details see https://stackoverflow.com/questions/8666316/facebook-oauth-2-0-code-and-token
The "Authzcode," more commonly known as the "OAuth Authorization Code" is used in the Authorization Grant process. This specific OAuth process is used, when an application needs to ensure that a resource owner's credentials are never shared with the client. This specific use case can come into play when the client is running untrusted code, such as an app that needs privileged access. Below is a quote from RFC-6749:
The authorization code provides a few important security benefits, such as the ability to authenticate the client, as well as the transmission of the access token directly to the client without passing it through the resource owner's user-agent and potentially exposing it to others, including the resource owner.
