'OAuth 2.0 - Does the authorization server directly sends the auth code to the redirect URI that the user specified?
Does the authorization server directly sends the auth code to the Redirect URI that the client specified or else Is there an Intermediate to whom the auth code will be sent first? If the auth code will be sent to the redirect URL ,then that redirect URL is an endpoint of the client's backend server?
Solution 1:[1]
Yes, the authorization code is sent from the authorization server to the web-backend-server via the browser redirect URL
Why via the browser: Because it's the application the user used to consent/login
Why auth code not token: Because URLS are visible in browser and network appliances
The step after that is the web-backend-server will exchange the auth code with a token from the auth server
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | Majid ALSarra |