CODEWITHSUNDEEP
httpoauthauthorizationoauth-2.0
Lifu Huang
Lifu Huang

Reputation: 12828

Why Authorization Code is necessary in Oauth2?

Authorization Code Grant is one of the four authorization grant types in OAuth2. In Implicit Grant, authorization token is directly sent back in response, but in Authorization Code Grant, code is sent back in response, which will then be used for retrieving token from authorization server.

My question is, why Authorization Code is necessary for Authorization Code Grant, instead of directly sending back token as is done in Implicit Grant?

Upvotes: 1

Views: 308

Answers (1)

sdoxsee
sdoxsee

Reputation: 4701

With the authorization code grant, the exchange of an authorization code for a token happens on the server-side (i.e. not directly in the browser). This way the client secret and token can be kept more "safely" on the server. Read here about the "simplifications" the implicit flow makes at the expense of some security implications

Upvotes: 3

Related Questions