OAuth 2.0 - Does the authorization server directly send the auth code to the redirect URI that the user specified?

634 views Asked by At

Does the authorization server directly send the auth code to the Redirect URI that the client specified or else Is there an Intermediate to whom the auth code will be sent first? If the auth code will be sent to the redirect URL ,then that redirect URL is an endpoint of the client's backend server?

1

There are 1 answers

0
Majid ALSarra On BEST ANSWER

Yes, the authorization code is sent from the authorization server to the web-backend-server via the browser redirect URL

Why via the browser: Because it's the application the user used to consent/login

Why auth code not token: Because URLS are visible in browser and network appliances

The step after that is the web-backend-server will exchange the auth code with a token from the auth server