Authorization code flow in Rest API - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to start the authorization request by redirecting the user to the authorization endpoint.

Rest API

GET /authorize?response_type=[1]&client_id=CLIENT_ID&redirect_uri=REDIRECT_URI&scope=read

Drag options to blanks, or click blank then click option'

Aid_token

Btoken

Crefresh_token

Dcode

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'token' instead of 'code' for response_type.

The response_type=code tells the authorization server to return an authorization code.

2fill in blank

medium

Complete the code to exchange the authorization code for an access token.

Rest API

POST /token
Content-Type: application/x-www-form-urlencoded

grant_type=[1]&code=AUTH_CODE&redirect_uri=REDIRECT_URI&client_id=CLIENT_ID&client_secret=CLIENT_SECRET

Drag options to blanks, or click blank then click option'

Aauthorization_code

Brefresh_token

Cclient_credentials

Dpassword

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'refresh_token' or other grant types incorrectly.

The grant_type=authorization_code is used to exchange the code for tokens.

3fill in blank

hard

Fix the error in the redirect URI parameter to ensure it matches the registered URI exactly.

Rest API

GET /authorize?response_type=code&client_id=CLIENT_ID&redirect_uri=[1]&scope=read

Drag options to blanks, or click blank then click option'

Ahttps://example.com/callback?extra=1

Bhttps://example.com/callback/

Chttps://example.com/callback

Dhttp://example.com/callback

Attempts:

3 left

💡 Hint

Common Mistakes

Adding trailing slash or query parameters to redirect URI.

The redirect URI must exactly match the registered URI without extra slashes, query parameters, or different schemes.

4fill in blank

hard

Fill both blanks to correctly include the state parameter and response type in the authorization request.

Rest API

GET /authorize?response_type=[1]&client_id=CLIENT_ID&redirect_uri=REDIRECT_URI&state=[2]

Drag options to blanks, or click blank then click option'

Acode

Bxyz123

Cabc456

Dtoken

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'token' as response_type or missing state parameter.

The response_type should be 'code' and state is a random string to prevent CSRF attacks.

5fill in blank

hard

Fill all three blanks to correctly parse the authorization code from the redirect URI and prepare the token request.

Rest API

redirect_uri = 'https://example.com/callback?code=[1]&state=xyz123'

code = redirect_uri.split('[2]')[1].split('&')[0]

payload = {'grant_type': '[3]', 'code': code, 'redirect_uri': 'https://example.com/callback', 'client_id': 'CLIENT_ID', 'client_secret': 'CLIENT_SECRET'}

Drag options to blanks, or click blank then click option'

Aauthcode123

Bcode=

Cauthorization_code

Dstate=

Attempts:

3 left

💡 Hint

Common Mistakes

Splitting on wrong parameter or using wrong grant_type.

The code is extracted by splitting on 'code=' and the grant_type is 'authorization_code' for the token request.