How deeply does Building Distributed Applications that Work cover authorization code flow?

Defines the code response and server-side token exchange, then describes configuration options without detailing exchange execution.

Authorization code flow

As explained in Building Distributed Applications that Work

The authorization code flow is an OAuth-based protocol in which a client exchanges an authorization code for tokens through a server-side interaction.

An authorization code flow lets a client obtain tokens through a server-side exchange: the identity provider returns a code, which the application exchanges for tokens. In an ASP.NET Core UI app, OpenID Connect options request a code response; tokens can be saved for later use. section 8.3

Configuration can include client credentials and a callback path for the identity provider’s response. PKCE adds protection and is especially relevant to public clients; it is optional in the configuration described here. section 8.3

Listing 8.1 Configuring authentication in the UI app startup

public static void ConfigureWebAppOpenIdConnect(this AuthenticationBuilder authentication)
{
    // Named options
    authentication.Services
        .AddOptions<OpenIdConnectOptions>(
            OpenIdConnectDefaults.AuthenticationScheme)
        .Configure<
            IConfiguration,
            IHttpClientFactory,
            IHostEnvironment>(Configure);

    // Unnamed options
    authentication.Services.AddOptions<OpenIdConnectOptions>()
        .Configure<
            IConfiguration,
            IHttpClientFactory,
            IHostEnvironment>(Configure);

    static void Configure(
        OpenIdConnectOptions options,
        IConfiguration configuration,
        IHttpClientFactory httpClientFactory,
        IHostEnvironment hostEnvironment)
    {
        var backchannelHttpClient =
            httpClientFactory.CreateClient(
                "OidcBackchannel");

        options.Backchannel = backchannelHttpClient;
        options.Authority =
            backchannelHttpClient
                .GetIdpAuthorityUri().ToString();
        options.ClientId = "webapp";
        options.ClientSecret =
            Environment
                .GetEnvironmentVariable(
                    "Identity__ClientSecret");
        options.ResponseType =
            OpenIdConnectResponseType.Code;
        options.SaveTokens = true;
        options.RequireHttpsMetadata =
            !hostEnvironment.IsDevelopment();
        options.MapInboundClaims = false;
    }
}

Inspect the UI app’s OpenID Connect configuration, including how its options are registered and configured. section 8.3

How Building Distributed Applications that Work covers it

Cover of Building Distributed Applications that Work

liveBook manning.com

Read Building Distributed Applications that Work on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Spring in Action, Sixth EditionAn OAuth2 flow in which a client exchanges a short-lived authorization code for an access token after the resource owner grants consent.
liveBook manning.com

Software Security for DevelopersThe authorization code flow is an OAuth flow in which a client obtains an authorization code through user authorization and exchanges it for an access token.
liveBook manning.com

Secure APIsThe authorization code flow is an OAuth authorization flow in which a client obtains an authorization code through user authorization and exchanges it for tokens.
liveBook manning.com

Authorization in ActionThe authorization code grant is an OAuth flow in which a client obtains a short-lived authorization code after user authorization and exchanges it for an access token.
liveBook manning.com

Spring Security in Action, Second EditionThe authorization code grant type is an OAuth flow in which a client obtains a token through an authorization code, commonly after user authentication.
liveBook manning.com

Quarkus in ActionThe authorization code flow is an OAuth-based authentication pattern in which a client redirects an unauthenticated user to an identity provider and exchanges a returned authorization code for tokens.
liveBook manning.com

ASP.NET Core in Action, 3eAn authorization code is a short-lived intermediary credential that a client exchanges, together with appropriate authentication, for an access token.

Compare how 8 books explain authorization code flow →

Related concepts

API keyproduces · An API key is a credential used to identify or authorize a client accessing an application programming interface.
OAuthpart of · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
client credentials grant typecontrasts with · The client credentials grant is an OAuth authorization flow in which a client authenticates with its own credentials to obtain an access token without user involvement.
grant typekind of · A grant type is an OAuth-defined authorization flow or token-request parameter specifying how a client obtains an access token.
authorization codeuses · An authorization code is a short-lived credential issued by an authorization server for a client to exchange for an access token.
Proof Key for Code Exchangeused by · Proof Key for Code Exchange (PKCE) is an OAuth security extension in which a client proves possession of a per-request secret when exchanging an authorization code.

This explainer was generated by Manning's knowledge graph from the text of Building Distributed Applications that Work. The section links point to the parts of the book it draws on.