Authorization Code Flow for OAuth 2.0
The OAuth 2.0 Authorization code flow is for web applications with server side components, which allow confidentiality for the customer to be kept on the permission server (confidential client). In general, permission servers need a secret when requesting authentication if more sensitive personal data, such as personal data or refresh tokens have been desired. If you don’t, you will only obey the Implicit OAuth 2.0 flow which returns only an access token from the permit server.
In the Authorization Code flow, the server-side component of the web application can freely manage the user’s session upon authenticating with the authorization server without revealing anything about the authorization server’s response (such as personal data or refresh token) to the end-user.
A Typical Authorization Code Workflow:
You can read more in detail in this article about Authorization Code Flow for Auth 2.0:
https://www.loginradius.com/blog/async/authorization-code-flow-oauth/
#authentication #authorization #cybersecurity #dataprivacy #programming #technology