+ In order to initiate the Authorization Code Flow, we need to build the authorization URL + and redirect the user to the authorization server. The URL is constructed as follows: +
Let's break it down...
URL of the authorization endpoint on the server. How is this path constructed will - differ between OAuth providers (such as Keycloak or Okta). to - find out the proper URL, there always exists - /.well-known/openid-configuration endpoint that contains all the necessary - information. + differ between OAuth providers (such as Keycloak, Okta, etc.).
response_type=
OAuth 2.0 response type. In this case, we are using the Authorization Code flow, so - we are requesting the authorization code.
+ we are requesting the authorization code.client_id=
@@ -89,20 +90,23 @@scope=
Scopes requested by the client. Scopes are used to limit the access of the access - token. In this case, we are requesting the offline_access scope, + token. In this case, we are requesting the offline_access scope, which allows the client to obtain a refresh token.
state=
-State parameter. This is an optional parameter that the client can use to maintain +
State parameter. This is an optional parameter that the client can use to maintain state between the request and callback. The authorization server includes this parameter when redirecting the user back to the client, allowing the client to verify that the response is coming from the - server and not a malicious third party.
+ server and not a malicious third party (CSRF attack).