Successfully added
Software Development
by Patrik
Authorization Code Grant
The authorization server will issue:
- an
id_tokenused by the application to authenticate the user and - an
access_tokenwhich is used by the application to call the API on the users' behalf.
Specification: OAuth 2.0 Authorization Code Grant
...see more
- The user navigates to SPA, which redirects the user to IdP to sign in.
- User signs in (and authorizes the application, if needed).
- IdP returns the user to SPA with Authorization Code.
- JavaScript code in SPA sends the Authorization Code to a login endpoint on the REST API Server.
- The REST API Server sends a request to the IdP Server containing the Authorization Code (and usually also a Client ID and Client Secret, which identify the REST API Server to the IdP server).
- The IdP validates the Authorization Code and sends the Access Token and ID Token to the REST API Server.
- The REST API Server stores the Access Token and ID Token in its memory and send its own Session Token back to the SPA.
- For every request the SPA makes to the REST API Server, it includes the Session Token which the REST API Server gave it. If the REST API Server needs to request resources from another server, it uses the stored Access Token to make that request.
Referenced in:
Comments