Authorization Code Flow

1
2
3
Build the authorization URL and redirect the user to the authorization server
After the user is redirected back to the client, verify the state matches
Exchange the authorization code for an access token
2. Verify the state parameter

You have now been redirected back to the application, to the page that was specified in the redirect-url parameter. In the URL you can notice, that there are addtional query parameters:

Let's break it down...

  • state=

    This is the state parameter that was sent in the initial request. It is used to prevent CSRF attacks.

  • session_state=

    Session state is a parameter that is used to maintain state between the request and callback. It is used to prevent CSRF attacks.

  • code=

    This is the authorization code that will be exchanged for an access token.

Now we have everything necessary to obtain token for the user. But is the state we have sent equivalent to the one we received back?

States are matching