How deeply does Quarkus in Action cover authorization code flow?

Explains redirect behavior and Quarkus configuration but does not detail token exchange internals.

Authorization code flow

The authorization code flow is an OAuth-based authentication pattern in which a client redirects an unauthenticated user to an identity provider and exchanges a returned authorization code for tokens.

The authorization code flow protects a web application by redirecting unauthenticated requests to an identity provider, then returning the user to the application after authentication. In a Quarkus web application, setting the application type to web_app selects this interaction; service applications instead commonly use an Authorization header. section 6.1.2

A practical configuration combines application-wide protection with session logout:

Require authentication for every path by assigning /* to an authenticated permission policy. section 6.1.2
Set quarkus.oidc.application-type=web_app to enable the redirect-oriented flow. section 6.1.2
Set quarkus.oidc.logout.path=/logout to invalidate the active session. section 6.1.2

Logging in through Keycloak

Refreshing a protected /whoami page redirects the user to Keycloak. Signing in with the configured alice user returns the browser to /whoami as an authenticated user; invoking /logout invalidates the session. section 6.1.2

Listing 6.3 Security-related configuration in the Users service

quarkus.http.auth.permission.all-resources.paths=/*
quarkus.http.auth.permission.all-resources.policy=authenticated
quarkus.oidc.application-type=web_app
quarkus.oidc.logout.path=/logout

Inspect the compact Quarkus configuration that protects all resources, selects the web application flow, and exposes logout. section 6.1.2

How Quarkus in Action covers it

liveBook manning.com

Read Quarkus in Action on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Spring in Action, Sixth EditionAn OAuth2 flow in which a client exchanges a short-lived authorization code for an access token after the resource owner grants consent.
liveBook manning.com

Software Security for DevelopersThe authorization code flow is an OAuth flow in which a client obtains an authorization code through user authorization and exchanges it for an access token.
liveBook manning.com

Secure APIsThe authorization code flow is an OAuth authorization flow in which a client obtains an authorization code through user authorization and exchanges it for tokens.
liveBook manning.com

Authorization in ActionThe authorization code grant is an OAuth flow in which a client obtains a short-lived authorization code after user authorization and exchanges it for an access token.
liveBook manning.com

Spring Security in Action, Second EditionThe authorization code grant type is an OAuth flow in which a client obtains a token through an authorization code, commonly after user authentication.
liveBook manning.com

ASP.NET Core in Action, 3eAn authorization code is a short-lived intermediary credential that a client exchanges, together with appropriate authentication, for an access token.
liveBook manning.com

Building Distributed Applications that WorkThe authorization code flow is an OAuth-based protocol in which a client exchanges an authorization code for tokens through a server-side interaction.

Compare how 8 books explain authorization code flow →

Related concepts

API keyproduces · An API key is a credential used to identify or authorize a client accessing an application programming interface.
OAuthpart of · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
client credentials grant typecontrasts with · The client credentials grant is an OAuth authorization flow in which a client authenticates with its own credentials to obtain an access token without user involvement.
grant typekind of · A grant type is an OAuth-defined authorization flow or token-request parameter specifying how a client obtains an access token.
authorization codeuses · An authorization code is a short-lived credential issued by an authorization server for a client to exchange for an access token.
Proof Key for Code Exchangeused by · Proof Key for Code Exchange (PKCE) is an OAuth security extension in which a client proves possession of a per-request secret when exchanging an authorization code.

This explainer was generated by Manning's knowledge graph from the text of Quarkus in Action. The section links point to the parts of the book it draws on.