Authorization code flow in Rest API - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the final access token value?

Consider the following simplified steps of an Authorization Code Flow in a REST API:

1. Client redirects user to authorization server with client_id and redirect_uri.
2. User logs in and authorizes the client.
3. Authorization server redirects back with a code.
4. Client exchanges the code for an access token.

Given the code snippet below simulating the token exchange, what is the value of access_token after execution?

Rest API

def exchange_code_for_token(code):
    if code == "auth123":
        return {"access_token": "token_abc123", "expires_in": 3600}
    else:
        return {"error": "invalid_code"}

response = exchange_code_for_token("auth123")
access_token = response.get("access_token", None)
print(access_token)

A None

B invalid_code

C token_abc123

D auth123

💡 Hint

Look at what the function returns when the code matches "auth123".

The function exchange_code_for_token returns a dictionary with the key access_token set to "token_abc123" when the code is "auth123". The variable access_token extracts this value, so the output is "token_abc123".

🧠 Conceptual

intermediate

Which step is missing in this Authorization Code Flow?

In the Authorization Code Flow, the client first redirects the user to the authorization server. The user logs in and the server redirects back with a code. The client then uses this code to request an access token.

Which important step is missing from this description?

A User enters their password twice

B Authorization server sends refresh token before access token

C Client directly receives the access token without a code

D Client authenticates itself when exchanging the code for the token

💡 Hint

Think about how the client proves it is allowed to exchange the code.

In the Authorization Code Flow, the client must authenticate itself (usually with client ID and secret) when exchanging the authorization code for an access token. This prevents misuse of the code by unauthorized parties.

🔧 Debug

advanced

Why does this token exchange request fail?

Look at the HTTP POST request below that the client sends to exchange the authorization code for an access token:

POST /token HTTP/1.1
Host: auth.example.com
Content-Type: application/x-www-form-urlencoded

code=abc123&redirect_uri=https://client.app/callback

The server responds with an error: invalid_client.

What is the most likely reason for this error?

A The client did not include its client_id and client_secret in the request

B The redirect_uri does not match the one used in the authorization request

C The authorization code is expired

D The Content-Type header is incorrect

💡 Hint

Think about how the server verifies the client identity during token exchange.

The invalid_client error means the server did not receive valid client credentials. The client must authenticate itself (usually with client_id and client_secret) when exchanging the code for a token.

📝 Syntax

advanced

Which code snippet correctly extracts the authorization code from a redirect URL?

A client receives a redirect URL after user authorization:

https://client.app/callback?code=xyz789&state=abc

Which Python code correctly extracts the code parameter value?

A

from urllib.parse import urlparse, parse_qs
url = 'https://client.app/callback?code=xyz789&state=abc'
query = urlparse(url).query
code = parse_qs(query)['code'][0]
print(code)

B

url = 'https://client.app/callback?code=xyz789&state=abc'
code = url.split('code=')[1].split('&')[0]
print(code)

C

url = 'https://client.app/callback?code=xyz789&state=abc'
code = url.split('?')[1].split('=')[1]
print(code)

D

url = 'https://client.app/callback?code=xyz789&state=abc'
code = url.split('&')[0].split('=')[1]
print(code)

💡 Hint

Use standard Python libraries to parse URLs safely.

Option A uses urlparse and parse_qs to safely extract query parameters. Other options rely on fragile string splitting that can break if order changes.

🚀 Application

expert

What is the correct sequence of steps in the Authorization Code Flow?

Order the following steps correctly as they happen in the Authorization Code Flow:

A 2,1,3,4

B 1,2,3,4

C 1,3,2,4

D 3,2,1,4

💡 Hint

Think about the natural order of user interaction and server responses.

The correct order is: client sends user to authorization server (1), user logs in and authorizes (2), server redirects back with code (3), client exchanges code for token (4).