From the course: Web Security: OAuth and OpenID Connect (2019)

Unlock the full course today

Join today to access over 22,600 courses taught by industry experts or purchase this course individually.

Overview: Authorization code flow

Overview: Authorization code flow

From the course: Web Security: OAuth and OpenID Connect (2019)

Start my 1-month free trial

Overview: Authorization code flow

“

- [Instructor] The first grant type we'll cover is the Authorization Code Flow. Of all them it's my favorite as it tends to be the most secure by default. But instead of talking about it, let's just see the steps of the flow. In practice this is what it looks like. You navigate to a page and request to log in. Next, the server sends you to the identity provider or an authorization server that you both trust and you perform the authentication and grant the authorizations requested. You don't immediately get back an access token, instead you get back an authorization code, or auth code. Now the web application can use the auth code, the client ID and the client secret to hit the token endpoint and get back the access and refresh tokens and it's done entirely via the backend. And that's it. Now the security benefits of this are very clear. The end user briefly sees the auth code, but since it's a one-time use code and…

Contents