Device would typically show the user code on it's display (or in console output when connection to display-less device via SSH for example) and where possible, also the URL that the user should visit. Based on the capabilities the URL could be shown as a simple text, or QR code, or if the device didn't have display capable enough, than the URL could be written in a manual distributed with the device.
-
-
+
+
User code:
-
+
-
+
-
+
Now that we have the user code, we can for example scan a QR code and finalize this flow on our mobile device:
@@ -127,7 +127,7 @@
Or for the purposes of this demo, you can click on the button below to open a new window, and finalize this flow there (If no windows pops up, make sure that the pop-up window is not blocked);
Before we can start the authorization process, we need to create a code verifier and a code challenge. The code verifier is a cryptographically random string that is used to verify the identity of the client. The code challenge is a hashed version of the code verifier, which is sent to the authorization server. The authorization server will then compare the code challenge with the code verifier to verify the identity of the client.
-
+
Generate Code Verifier
-
+
@@ -76,10 +76,10 @@
Now that we habe the code verified, we need to create the code challenge. We do so by hashing the code verifier using the SHA256 algorithm and then encoding it using the URL-safe Base64 encoding.
This playground serves as an interactive platform designed to familiarize developers and students with the
intricacies of OAuth authentication processes. Beyond just theoretical knowledge, this playground provides practical
@@ -46,7 +46,7 @@