OAuth 2.0 flow in HLD - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to identify the first step in the OAuth 2.0 flow.

HLD

User initiates the OAuth 2.0 flow by sending a request to the [1] endpoint.

Drag options to blanks, or click blank then click option'

AClient Application

BResource Server

CAuthorization Server

DUser Database

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing the Resource Server with the Authorization Server.

Thinking the Client Application initiates the flow directly.

The OAuth 2.0 flow starts when the user sends a request to the Authorization Server to get permission.

2fill in blank

medium

Complete the code to specify the token type returned by the Authorization Server.

HLD

After successful authorization, the server returns an access token of type [1].

Drag options to blanks, or click blank then click option'

ABearer Token

BRefresh Token

CID Token

DSession Token

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing Refresh Token with Access Token.

Using Session Token which is not part of OAuth 2.0.

The Authorization Server returns a Bearer Token which the client uses to access protected resources.

3fill in blank

hard

Fix the error in the OAuth 2.0 flow step where the client exchanges the authorization code.

HLD

Client sends the authorization code to the [1] to exchange it for an access token.

Drag options to blanks, or click blank then click option'

AResource Server

BUser Agent

CClient Application

DAuthorization Server

Attempts:

3 left

💡 Hint

Common Mistakes

Sending the code to the Resource Server instead of the Authorization Server.

Confusing the Client Application as the recipient of the code.

The client must send the authorization code to the Authorization Server to get an access token.

4fill in blank

hard

Fill both blanks to complete the OAuth 2.0 flow diagram steps.

HLD

1. User requests access from [1].
2. Client uses an access token to access the [2].

Drag options to blanks, or click blank then click option'

AAuthorization Server

BRefresh Token

CResource Server

DClient Application

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up the roles of Authorization Server and Resource Server.

Using Refresh Token instead of access token for resource access.

The user requests access from the Authorization Server, and the client uses the access token to access the Resource Server.

5fill in blank

hard

Fill all three blanks to complete the OAuth 2.0 token request code snippet.

HLD

POST /token HTTP/1.1
Host: [1]
Content-Type: application/x-www-form-urlencoded

grant_type=[2]&code=[3]

Drag options to blanks, or click blank then click option'

Aauthorization-server.com

Bauthorization_code

Cauth_code_value

Dresource-server.com

Attempts:

3 left

💡 Hint

Common Mistakes

Using Resource Server as host instead of Authorization Server.

Using wrong grant_type values.

Confusing the authorization code with other tokens.

The token request is sent to the Authorization Server with grant_type 'authorization_code' and the actual authorization code value.