1

While learning how OAuth2 works, I cannot figure out why there is a separate step to retrieve Access Token?

A separate step means:

  • an extract HTTP request
  • passing Client Secret in the URL

I'd expect the Access Token to be generated in the "authorization" step, encrypted with using the Client Secret, and returned back when redirecting to the Callback URL. Then the client application would decrypt it and use it straight await without issuing an extra HTTP request.

I guess there are some reasons behind having an extra step, and I'm just not aware of them. I hope you can explain the reasons in your answer.

Meglio
  • 1,646
  • 2
  • 17
  • 33

1 Answers1

3

I'm assuming you're talking about the Authorization Code flow and not the Implicit flow, which does return a token directly.

The Authorization Code flow is designed to work with potentially unencrypted servers via a callback URL (this was designed years before Let's Encrypt and the relatively recent encrypt-everything push). Thus, the URL could be intercepted by any intermediate routers/proxies, and sending an access code as part of the callback URL in that environment is a Bad Idea.

So instead, the authorization code is sent. Then the client exchanges the authorization code along with its client secret for an access token. The authorization code can be intercepted, but in the Authorization Code flow, the client secret is actually secret and not known outside your server, so any intercepted authorization code is useless on its own.

These days, encryption is common and free, and unencrypted flows are strongly discouraged. The extra call remains part of the Authorization Code flow for historical reasons.

Community
  • 1
  • 1
Stephen Cleary
  • 437,863
  • 77
  • 675
  • 810
  • Thanks, so this it the key: "The extra call remains part of the Authorization Code flow for historical reasons". Does it mean there are no extra risks if Access Token is sent through URL in an encrypted form straight away (instead of the Authorization Code), with the Secret Key is used for encryption? – Meglio Jul 22 '20 at 11:11
  • 1
    Well, in the normal Auth Code flow, the "client" is your API server that needs the token. The user interacts with a browser. Auth Code flow means the browser only sees the auth code, and the browser never gets the token directly. Returning the token directly (i.e., including it in the redirect url) would expose it to the browser, which comes with other security risks. – Stephen Cleary Jul 22 '20 at 20:27