Protocols
Authorization code flow
The OAuth 2.0 flow where the browser receives a short-lived code that the application exchanges for tokens from its server.
What Authorization code flow means
The authorization code flow keeps tokens out of the browser. The identity provider returns a short-lived code through the redirect, and the application exchanges that code for tokens over a direct back-channel call. Combined with PKCE it is the recommended flow for essentially every application type.
Defined in: RFC 6749 §4.1, with PKCE in RFC 7636.
How it works
The separation is the point. A redirect URL passes through browser history, referrer headers, server logs and sometimes a corporate proxy. A code that is single-use and expires in seconds is a poor prize; an access token and a refresh token are an excellent one. The implicit flow put the latter in the redirect, which is why it is no longer recommended.
For a public client — a single-page application or a mobile app — there is no confidential client secret to present at the exchange, so PKCE supplies the binding instead. For a confidential server-side client, both are used.
Redirect URI validation must be exact-match. Prefix or wildcard matching lets an attacker who controls any path under an allowed origin receive the code, and this is a live vulnerability class rather than a theoretical one.
The mistake people actually make
Exchanging the code from the browser on a confidential client, which exposes the client secret to anyone who opens developer tools. The exchange belongs on the server.
Related terms
PKCE
Proof Key for Code Exchange — binds an authorization code to the client that requested it, so a stolen code is useless.
OAuth 2.0
An authorization framework that lets an application obtain limited access to a resource without handling the user's credentials.
OpenID Connect (OIDC)
An identity layer on top of OAuth 2.0 that lets an application verify who a user is, not just what it may access.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.