Authorization code flow is optimized for confidential clients, but it can be used for public clients as well. It is used to obtain access tokens and refresh tokens:
- The process starts when the client (for example, the MVC app) redirects the user agent (browser) to the authorization server.
- The client passes its client credentials (client ID and secret), scope, state, and redirection URI to the authorization server.
- If the client is authorized, the authorization server will ask the resource owner to enter the resource owner credentials.
- The authorization server takes the resource owner credentials and authenticates it.
- If the resource owner is authenticated, the authorization server asks to either grant or deny permissions ...