2

Something I can't wrap my head around. As I understand the authorization code flow is supposed to be more secured than the implicit flow, because the tokens are not directly sent to the client from the authorization server, but rather retrieved by your backend. So the flow is basically:

  1. Browser gets the authorization code (as a URL parameter of sort).
  2. Sends it to a public backend endpoint.
  3. The backend sends the code + client secret to the authorization server, retrieves the tokens and stores them in the client's cookie/local storage for further use.

In this flow all the tutorials describe the authorization code as useless to the hacker, why is that? Can't a hacker use Postman or some other client and access your (public) API directly, make it go through step 3 and thus retrieve the tokens just the same?

What am I missing here?

Matan
  • 33
  • 1
  • 4

2 Answers2

3

The code is used exactly once. In many scenarios that an attacker might get access to the code, it's already been exchanged for an access token and therefore useless.

The authorization_code is a one-time token.

Evert
  • 93,428
  • 18
  • 118
  • 189
  • 1
    A small follow up: Could it be possible to intercept the authorization code and access the BE API before the actual flow completes, thus hijacking the tokens? Is there a best practice to protect against such a scenario? – Matan Jun 03 '21 at 18:41
  • 3
    @Matan, yes. You should use PCKE. This is an extension of the `authorization_code` flow. – Evert Jun 03 '21 at 18:46
1

Authorization Code aka auth code is used publicly so that the client can establish a secure back channel between him and the authorization server so that he can exchange it with the access token without the use of a browser.

The auth code is public and can be intercepted via a proxy since it appears in the query of the redirect_uri and is used via the browser (which is considered insecure). The access token depends on the auth_code (public) and the client_secret (private) for the exchange. Without the client_secret an attacker can get the access token with brute-forcing this way through.

Summary: even if the attacker knows the authcode he can do anything without the client_secret given to the client at registration (or dynamically) and assumed to be secured.

Omar Jarkas
  • 100
  • 5