Does the authorization server directly sends the auth code to the Redirect URI that the client specified or else Is there an Intermediate to whom the auth code will be sent first? If the auth code will be sent to the redirect URL ,then that redirect URL is an endpoint of the client's backend server?
1 Answers
Yes, the authorization code is sent from the authorization server to the web-backend-server via the browser redirect URL
Why via the browser: Because it's the application the user used to consent/login
Why auth code not token: Because URLS are visible in browser and network appliances
The step after that is the web-backend-server will exchange the auth code with a token from the auth server
Related