Which is a benefit of three-legged OAuth (authonzation_code grant)'?

The primary benefit of the three-legged OAuth 2.0 Authorization Code grant type is delegated authorization. It allows a third-party client application to access protected, user-specific resources on a resource server on behalf of the end-user. This is achieved without the client application ever handling or storing the end-user's sensitive credentials (e.g., username and password). The user authenticates directly with a trusted authorization server, which then provides a temporary authorization code to the client. The client exchanges this code for an access token, securely decoupling authentication from authorization and protecting user credentials.

A. An authorization code is a temporary, single-use credential. It is exchanged for an access token and then invalidated to prevent replay attacks.

B. This is imprecise. Access is granted to a client application with the user's explicit consent, not arbitrarily to "another individual."

D. This is the exact problem that three-legged OAuth is designed to prevent. The core principle is to avoid sharing end-user credentials with the client application.

1. Google Cloud Apigee Documentation: In the "Implementing the authorization code grant type" section

it states

"The primary advantage of the authorization code grant type is that public clients are never exposed to the credentials of the resource owner."

Source: Google Cloud

Apigee Documentation

Implementing the authorization code grant type.

2. The OAuth 2.0 Authorization Framework (RFC 6749): The official specification describes the flow where the client directs the resource owner to the authorization server. "Instead of requesting authorization directly from the resource owner

the client directs the resource owner to an authorization server... which in turn directs the resource owner back to the client with the authorization code." This flow explicitly separates the client from the user's authentication.

Source: IETF

RFC 6749

Section 1.3.1

"Authorization Code".

3. Google Cloud Apigee Documentation: The overview of OAuth 2.0 states

"The authorization code grant type is used to obtain both access tokens and refresh tokens and is optimized for confidential clients. Since this is a redirection-based flow

the client must be capable of interacting with the resource owner's user-agent... and of receiving incoming requests (via redirection) from the authorization server." This redirection is key to ensuring the client never sees the user's credentials.

Source: Google Cloud

Apigee Documentation

OAuth 2.0.