Authorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE for public clients.
This is the flow to use for anything with a human in it. The code is useless without the exchange, and the exchange happens over a channel the browser never sees, which is what keeps tokens out of URLs, browser history, and referrer headers. Implicit flow, which returned tokens directly in the redirect, is deprecated in OAuth 2.1 precisely because it lacked that separation. Public clients add PKCE so an intercepted code cannot be redeemed by anyone else.
See also: OAuth 2.0, OAuth 2.1, PKCE, OIDC authorization code with PKCE recipe
Related on Start with Identity
- GlossaryAuthorization Server
In OAuth 2.0, the component that authenticates the resource owner, obtains their authorization, and issues access tokens to clients. It exposes the authorizatio
- GlossaryDevice Authorization Grant
An OAuth 2.0 flow (RFC 8628) for input-constrained devices like TVs and CLIs. The user authorizes on a second device using a short code. Device code flow is the
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- GlossaryFAPI
Financial-grade API. A hardened OAuth and OIDC security profile from the OpenID Foundation for high-risk APIs such as open banking, mandating stronger client au
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still