Refer to the exhibit. Drag and drop the steps from the left into the correct order of operation on the right for a successful OAuth2 three-legged authorization code grant flow.

Question

Explanation

This question tests knowledge of the OAuth2 Authorization Code Grant flow (three-legged), which involves three parties: the Client application, the Resource Owner (user), and the Authorization/Resource Server. Steps must be placed in the correct sequential order to achieve a successful token exchange and resource access.

Approach. The correct order is: (1) The Client redirects the Resource Owner's browser to the Authorization Server with a request including client_id, redirect_uri, response_type=code, scope, and state. (2) The Resource Owner authenticates and grants consent at the Authorization Server. (3) The Authorization Server redirects back to the Client with a short-lived Authorization Code. (4) The Client sends the Authorization Code plus its client credentials to the Authorization Server's token endpoint (back-channel). (5) The Authorization Server validates and returns an Access Token (and optionally a Refresh Token). (6) The Client presents the Access Token to the Resource Server to retrieve the protected resource.

Concept tested. OAuth2 Authorization Code Grant flow (three-legged OAuth): the precise sequence of redirects, code issuance, back-channel token exchange, and protected resource access - distinguishing front-channel (browser redirects) from back-channel (server-to-server) steps, and why the authorization code must be exchanged separately rather than returning a token directly to the browser.

Reference. RFC 6749 Section 4.1 – The OAuth 2.0 Authorization Framework: Authorization Code Grant

No community discussion yet for this question.