An authorization code is a short-lived credential that an authorization server sends to a client after the user authenticates and grants consent. The client exchanges this code for an access token, keeping the token exchange separate from the browser redirect. section 7.4.1
A typical authorization code flow works like this:
- The client redirects the user to the authorization server with a client ID, callback URI, and response_type=code. section 7.4.1
- The user authenticates, grants consent, and returns to the client with the code in the callback URL. section 7.4.1
- The client submits the code, client ID, client secret, and matching redirect URI to obtain an access token. section 8.4.1
- Protect the exchange with PKCE: generate a unique verifier, send its SHA-256 base64url challenge, and later prove possession with the verifier. section 7.4.2
A web API login
A FastAPI server exposes GET /login and redirects the user to an OIDC provider. After login and consent, the provider redirects back with code=.... The server accepts that code at GET /token and posts it with grant_type=authorization_code, client credentials, and the callback URI. The provider returns an access token. If an attacker intercepts the code, they could exchange it first and impersonate the user; PKCE limits this attack by requiring the original verifier. section 8.4.1 section 7.4.2
Figure 8.3 Flow of requests involved in obtaining an access token. The process begins with the user visiting the server’s login page. The API redirects the client to Auth0’s login screen, where the user authenticates and grants consent; then the user is redirected back to the API with the authorization code, which is finally exchanged for an access token.
Trace the complete request sequence from the login page through authentication, consent, callback, code exchange, and access-token issuance. section 8.4.1
