Authorization code flow in Rest API - Mini Project: Build & Apply

Authorization Code Flow Simulation

📖 Scenario: You are building a simple simulation of the OAuth 2.0 Authorization Code Flow. This flow is used by many websites and apps to let users log in securely using another service, like Google or Facebook.In this project, you will create the basic steps of this flow using simple code to understand how the authorization code is requested, exchanged for a token, and then used to access user data.

🎯 Goal: Build a step-by-step simulation of the OAuth 2.0 Authorization Code Flow using simple REST API calls. You will create the initial authorization request, handle the authorization code, exchange it for an access token, and finally use the token to get user information.

📋 What You'll Learn

Create a dictionary to represent the client application details

Create a variable to hold the authorization code received

Write code to simulate exchanging the authorization code for an access token

Print the final access token and user info to show the flow works

💡 Why This Matters

🌍 Real World

OAuth 2.0 Authorization Code Flow is used by many apps and websites to let users log in securely without sharing passwords.

💼 Career

Understanding this flow is important for developers working on authentication, security, and integrating third-party login services.

1

Set up client application details

Create a dictionary called client_app with these exact entries: 'client_id': 'abc123', 'redirect_uri': 'https://example.com/callback', and 'scope': 'read_profile'.

Rest API

# Create the client_app dictionary with client_id, redirect_uri, and scope
# Your code here

Hint

Use curly braces {} to create a dictionary with the exact keys and values.

2

Store the authorization code

Create a variable called authorization_code and set it to the string 'authcode123' to simulate receiving an authorization code from the authorization server.

Rest API

client_app = {
    'client_id': 'abc123',
    'redirect_uri': 'https://example.com/callback',
    'scope': 'read_profile'
}
# Create the authorization_code variable and assign 'authcode123'
# Your code here

Hint

Just assign the string 'authcode123' to the variable authorization_code.

3

Exchange authorization code for access token

Create a dictionary called token_response that simulates the token server response with these exact entries: 'access_token': 'token456', 'token_type': 'Bearer', and 'expires_in': 3600. Use the authorization_code variable in a comment to show it is used in this step.

Rest API

client_app = {
    'client_id': 'abc123',
    'redirect_uri': 'https://example.com/callback',
    'scope': 'read_profile'
}
authorization_code = 'authcode123'
# Create token_response dictionary simulating token exchange using authorization_code
# Your code here

Hint

Create a dictionary with the exact keys and values to represent the token response.

4

Print the access token and user info

Create a dictionary called user_info with these exact entries: 'id': 'user789' and 'name': 'Alice'. Then print the access_token from token_response and the user_info dictionary on separate lines.

Rest API

client_app = {
    'client_id': 'abc123',
    'redirect_uri': 'https://example.com/callback',
    'scope': 'read_profile'
}
authorization_code = 'authcode123'
# Using authorization_code to exchange for token
token_response = {
    'access_token': 'token456',
    'token_type': 'Bearer',
    'expires_in': 3600
}
# Create user_info dictionary and print access_token and user_info
# Your code here

Hint

Create the user_info dictionary and use print() to show the access token and user info.

Practice

1. What is the main purpose of the authorization code in the Authorization Code Flow?

easy

A. To exchange it for an access token securely

B. To directly access user data

C. To authenticate the user with a password

D. To refresh the access token automatically

Solution

1. Step 1: Understand the role of the authorization code

   The authorization code is a temporary code given after user consent, not the token itself.

2. Step 2: Identify what the app does with the code

   The app sends this code to the authorization server to get an access token securely.

3. Final Answer:

   To exchange it for an access token securely -> Option A

4. Quick Check:

   Authorization code = temporary code for token exchange [OK]

Hint: Authorization code is a temporary code, not a token [OK]

Common Mistakes:

• Thinking the code directly accesses data
• Confusing code with user password
• Assuming code refreshes tokens

2. Which HTTP method is typically used by the app to exchange the authorization code for an access token?

easy

A. DELETE

B. GET

C. PUT

D. POST

Solution

1. Step 1: Recall the token exchange request

   The app sends the authorization code to the token endpoint to get an access token.

2. Step 2: Identify the HTTP method used

   This request uses POST because it sends data securely in the request body.

3. Final Answer:

   POST -> Option D

4. Quick Check:

   Token exchange uses POST method [OK]

Hint: Token exchange sends data securely, so use POST [OK]

Common Mistakes:

• Using GET which exposes data in URL
• Confusing PUT or DELETE with token exchange
• Assuming token exchange is a simple GET request

3. Given this simplified token exchange request in Python:

import requests
response = requests.post('https://auth.example.com/token', data={
    'code': 'abc123',
    'client_id': 'myapp',
    'client_secret': 'secret',
    'redirect_uri': 'https://myapp.com/callback',
    'grant_type': 'authorization_code'
})
print(response.json().get('access_token'))

What will this code print if the exchange is successful?

medium

A. The authorization code 'abc123'

B. The access token string from the server

C. An error message about invalid client

D. None

Solution

1. Step 1: Understand the request purpose

   The code sends a POST request to exchange the authorization code for an access token.

2. Step 2: Analyze the printed output

   If successful, the server returns JSON with an 'access_token' key, which is printed.

3. Final Answer:

   The access token string from the server -> Option B

4. Quick Check:

   response.json()['access_token'] = access token [OK]

Hint: Successful exchange returns access token, not code [OK]

Common Mistakes:

• Printing the code instead of token
• Expecting error message on success
• Not accessing JSON correctly

4. In the Authorization Code Flow, a developer wrote this code snippet to exchange the code:

response = requests.get('https://auth.example.com/token', params={
    'code': 'abc123',
    'client_id': 'myapp',
    'client_secret': 'secret',
    'redirect_uri': 'https://myapp.com/callback',
    'grant_type': 'authorization_code'
})

What is the main issue with this code?

medium

A. Incorrect redirect URI format

B. Missing the authorization code parameter

C. Using GET instead of POST for token exchange

D. Client secret should not be sent

Solution

1. Step 1: Check HTTP method for token exchange

   The token exchange requires a POST request to send sensitive data securely.

2. Step 2: Identify the problem in the code

   The code uses GET with query parameters, which is insecure and not standard for this flow.

3. Final Answer:

   Using GET instead of POST for token exchange -> Option C

4. Quick Check:

   Token exchange must use POST, not GET [OK]

Hint: Token exchange always uses POST, not GET [OK]

Common Mistakes:

• Using GET exposes secrets in URL
• Forgetting to send client secret
• Assuming redirect URI format is wrong

5. A web app uses Authorization Code Flow with PKCE (Proof Key for Code Exchange). Which additional step does PKCE add to improve security?

hard

A. The app sends a code verifier with the token request to prove it initiated the flow

B. The app uses client secret only without authorization code

C. The user enters their password twice during login

D. The app skips the authorization code and uses implicit flow

Solution

1. Step 1: Understand PKCE purpose

   PKCE adds a code verifier and challenge to prevent interception of the authorization code.

2. Step 2: Identify the added step in the flow

   The app sends the code verifier with the token request to prove it started the flow and prevent attacks.

3. Final Answer:

   The app sends a code verifier with the token request to prove it initiated the flow -> Option A

4. Quick Check:

   PKCE adds code verifier step for security [OK]

Hint: PKCE adds code verifier to token request for security [OK]

Common Mistakes:

• Thinking PKCE removes authorization code
• Confusing PKCE with password prompts
• Assuming PKCE uses implicit flow