An application has initiated an OAuth authorization code grant flow to get access to an API resource on behalf of an end user. Which two parameters…

In the OAuth 2.0 authorization code grant flow, after the end-user authenticates and grants consent, the authorization server redirects the user-agent (browser) back to the application's pre-registered redirect URI. This redirect request includes two key parameters in the query string:

1. code: A temporary, single-use authorization code. The application will exchange this code for an access token in a subsequent back-channel request to the authorization server's token endpoint.

2. state: An opaque value used by the application to maintain state between the request and callback and to prevent Cross-Site Request Forgery (CSRF) attacks. The authorization server must return this value unmodified if it was included in the initial authorization request.

A. The access token and refresh token are provided by the authorization server's token endpoint in a later step, in exchange for the authorization code, not directly in the user-agent redirect.

B. The access token is not returned at this stage. It is obtained later by exchanging the authorization code.

C. The redirect URI is the destination of the redirect, not a parameter returned in the query string. The permission panel is displayed by the authorization server before this redirect occurs.

1. Internet Engineering Task Force (IETF) RFC 6749

"The OAuth 2.0 Authorization Framework":

Section 4.1.2

"Authorization Response": This section explicitly states that upon a successful grant by the resource owner

the authorization server redirects the user-agent to the client's redirection URI with the code and state parameters appended to the query component. It specifies code as "REQUIRED" and state as "REQUIRED if the 'state' parameter was present in the client authorization request."

2. Cisco DevNet Documentation

"Understanding OAuth 2.0":

"Authorization Code" section: This guide describes the flow

stating: "The Authorization Server redirects the user back to the application with an authorization code... The application can now exchange the authorization code for an access token." It also highlights the use of the state parameter for security. This aligns with the standard flow where code and state are returned post-consent.