Why does the authorization server send the authorization code as a redirect through the user-agent (browser) and not directly to the client callback URI?
In the most secure flow, due to numerous potential attack vectors, Access Tokens are not sent to the client backend via a redirect through the user-agent browser. This is stated in 3.4.
of the OAuth 2.0 Threat Model and Security Considerations
. So the redirect through the browser makes a short-lived auth code beneficial.
But let's assume the authorization server established a direct communication channel to the client via some previously specified URI. Could the server not just send the Access Token immediately and thus, simplify the flow?
state
parameter submitted with the request data. So this random id/string that was created by the client when the request was initiated, would serve to make the association with the user session.state
is an anti-csrf measure, it would be wrong to also use it for a completely different purpose.