2

Why does the authorization server send the authorization code as a redirect through the user-agent (browser) and not directly to the client callback URI?

In the most secure flow, due to numerous potential attack vectors, Access Tokens are not sent to the client backend via a redirect through the user-agent browser. This is stated in 3.4. of the OAuth 2.0 Threat Model and Security Considerations. So the redirect through the browser makes a short-lived auth code beneficial.

But let's assume the authorization server established a direct communication channel to the client via some previously specified URI. Could the server not just send the Access Token immediately and thus, simplify the flow?

4
  • How would the application associate the received token with a user session? Apr 20, 2020 at 16:46
  • Good question, I thought about that. I would say via the state parameter submitted with the request data. So this random id/string that was created by the client when the request was initiated, would serve to make the association with the user session.
    – Marcellvs
    Apr 20, 2020 at 17:03
  • state is an anti-csrf measure, it would be wrong to also use it for a completely different purpose. Apr 20, 2020 at 17:11
  • Valid point, then what about passing a user-specific ID so the client knows who the response belongs to? Is it impossible? I suppose there must have been another reason for not doing it that way. I actually thought it might have to do with that external servers (which are not logged in like the user) cannot access certain callback URLs for the response, , or it would decrease the flexibility in regard to handling such responses.
    – Marcellvs
    Apr 20, 2020 at 17:25

1 Answer 1

2

The browser navigated to the client application, got redirected to the authorization server, which did the user authentication and issued a code. If the authorization server would call the client application via a back-channel (direct server to server call), to pass the code to the client application, it would still need to redirect the browser back to the client application once done.

What would the browser do to associate itself with the issued code? How does the client application know that the incoming HTTP request belongs to the issued code?

Using a client generated state parameter for that is much riskier than a authorization server generated code (time to live of the second one is much smaller).

Also, not all authorization servers may be able to make outbound requests.

7
  • Regarding the first part: Good point, the user-agent should not indefinitely stay on the authorization server. Regarding paragraph 2: The state param is created by the client (e.g. hash of session cookie, as per 5.3.5. of the spec) and the server should answer with the same state. Why would usage of the state for association be risky in the case of using a direct back-channel?
    – Marcellvs
    Apr 21, 2020 at 8:23
  • Normally when the server issues a authorization code, it redirects the browser back to the client which immediately will exchange the code for an access token. State is generated before the client authenticates, leaving a bigger gap for it to be stolen.
    – MvdD
    Apr 21, 2020 at 16:27
  • 1
    Added extra line to answer with another reason this may not work.
    – MvdD
    Apr 21, 2020 at 16:29
  • The last line you added makes sense, but I did not consider that to be an option earlier. It should be noted though, there are two other flows that are back-channel only. My question was about why not moving to the back-channel earlier. But I guess there are a few drawbacks and going via an authorization code is not really that complicated.
    – Marcellvs
    Apr 30, 2020 at 17:16
  • @Marcellvs Keep in mind that flows that use the back-channel are initiating requests from client to authorization service, not the other way around. It's perfectly valid to limit the authorization service from initiating requests to other servers. Although for back-channel logout, this would be required.
    – MvdD
    Apr 30, 2020 at 17:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.