CODEWITHSUNDEEP
oauthoauth-2.0
Ramandeep S
Ramandeep S

Reputation: 345

why authorization code is necessary in authorization-grant-type

I am new to OAuth and was wondering why authorization code is required?

Why authorization does not send access token or refresh token in callback response.

why not directly access token?

Upvotes: 0

Views: 458

Answers (1)

Hans Z.
Hans Z.

Reputation: 54118

The Authorization Code grant uses the short-lived one-time code so that it can be exchanged for the real token (which is longer-lived and multiple-use) in a backchannel call that is more secure and can leverage credentials to authenticate the Client towards the Authorization Server.

The Implicit grant type returns the access token directly in the authorization response. It is considered to be more insecure because it is easier to attack (using crafted redirects etc.) and because there's no way to keep a client credentials secret.

Upvotes: 3

Related Questions