Authorization code flow

As explained in ASP.NET Core in Action, 3e

An authorization code is a short-lived intermediary credential that a client exchanges, together with appropriate authentication, for an access token.

The authorization code flow lets an application obtain an access token without handling the user’s service credentials. The user signs in with the provider, approves requested access, and returns with a short-lived authorization code. section 25.1.3

The flow proceeds in a small chain of handoffs:

• Redirect the user to the provider, such as Facebook, for sign-in. section 25.1.3
• Show a consent screen describing the data the application wants to access. section 25.1.3
• Redirect back to the application with an authorization code. section 25.1.3
• Exchange the code and a client-provider secret for an access token, then call the provider API. section 25.1.3

Dog photos from Facebook

A user asks dogphotos.com to retrieve dog photos from Facebook. Facebook handles sign-in and consent; dogphotos.com receives the authorization code, exchanges it for an access token, and uses that token to retrieve the photos. section 25.1.3

Figure 25.5 Using OAuth 2.0 to authorize dogphotos.com to access your photos on Facebook

Follow the sequence of redirects, consent, code exchange, and API access in the OAuth 2.0 flow diagram. section 25.1.3

How ASP.NET Core in Action, 3e covers it

How deep it goes

Explains the redirect, consent, callback, code exchange, and API call, but does not detail implementation code.

Examples

Uses dogphotos.com retrieving a user’s Facebook photos after consent and token exchange.

What it assumes

Assumes only a basic understanding of signing in, consent, redirects, tokens, and API calls.

What you can do after

Understand how to delegate API access through a provider without giving the application provider credentials.

How it connects

Connects authorization code flow with OAuth 2.0, access tokens, consent, provider APIs, and OpenID Connect.

liveBookmanning.com

Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Spring in Action, Sixth EditionAn OAuth2 flow in which a client exchanges a short-lived authorization code for an access token after the resource owner grants consent.
• 

  liveBookmanning.com
  Software Security for DevelopersThe authorization code flow is an OAuth flow in which a client obtains an authorization code through user authorization and exchanges it for an access token.
• 

  liveBookmanning.com
  Secure APIsThe authorization code flow is an OAuth authorization flow in which a client obtains an authorization code through user authorization and exchanges it for tokens.
• 

  liveBookmanning.com
  Authorization in ActionThe authorization code grant is an OAuth flow in which a client obtains a short-lived authorization code after user authorization and exchanges it for an access token.
• 

  liveBookmanning.com
  Spring Security in Action, Second EditionThe authorization code grant type is an OAuth flow in which a client obtains a token through an authorization code, commonly after user authentication.
• 

  liveBookmanning.com
  Quarkus in ActionThe authorization code flow is an OAuth-based authentication pattern in which a client redirects an unauthenticated user to an identity provider and exchanges a returned authorization code for tokens.
• 

  liveBookmanning.com
  Building Distributed Applications that WorkThe authorization code flow is an OAuth-based protocol in which a client exchanges an authorization code for tokens through a server-side interaction.

Compare how 8 books explain authorization code flow →

Related concepts

• API keyproduces · An API key is a credential used to identify or authorize a client accessing an application programming interface.
• OAuthpart of · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
• client credentials grant typecontrasts with · The client credentials grant is an OAuth authorization flow in which a client authenticates with its own credentials to obtain an access token without user involvement.
• grant typekind of · A grant type is an OAuth-defined authorization flow or token-request parameter specifying how a client obtains an access token.
• authorization codeuses · An authorization code is a short-lived credential issued by an authorization server for a client to exchange for an access token.
• Proof Key for Code Exchangeused by · Proof Key for Code Exchange (PKCE) is an OAuth security extension in which a client proves possession of a per-request secret when exchanging an authorization code.

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.