OAuth 2.0 Grant Type - Authorization Code

 OAuth 2.0 Brief Idea - To solve the access delegation problem by issuing a temporary time-bound token to a third-party web application that is only good enough for a well-defined purpose

OAuth 2.0 Actors

OAuth 2.0 introduces four actors in a typical OAuth flow. The following explains the role of each of them with respect to Figure 4-1:

1. Resource owner: One who owns the resources. In our example earlier, the third-party web application wants to access the Facebook wall of a Facebook user via the Facebook API and publish messages on behalf of him/her. In that case, the Facebook user who owns the Facebook wall is the resource owner.
    
   
2. Resource server: This is the place which hosts protected resources. In the preceding scenario, the server that hosts the Facebook API is the resource server, where Facebook API is the resource.
    
3. Client: This is the application which wants to access a resource on behalf of the resource owner. In the preceding use case, the third-party web application is the client.
    
4. Authorization server: This is the entity which acts as a security token service to issue OAuth 2.0 access tokens to client applications. In the preceding use case, Facebook itself acts as the authorization server.

    

    

   

   Step 1

    

   https://authz.example.com/oauth2/authorize?

                      response_type=code&

                      client_id=0rhQErXIX49svVYoXJGt0DWBuFca&

                      redirect_uri=https%3A%2F%2Fmycallback

   
    Step 5

   
   

   https://callback.example.com/?code=9142d4cad58c66d0a5edfad8952192