Backend interview prep

Start

Authorization Code Flow Interview Questions and Answers

Learn OAuth2 Authorization Code Flow with 10 interview questions, Mermaid diagrams, Spring Security examples, PKCE overview, and enterprise best practices.

Authorization Code Flow - Interview Questions & Answers

The Authorization Code Flow is the most secure and most widely used OAuth2 flow for web applications.

It is recommended by the OAuth2 specification and is supported by Spring Security, Keycloak, Okta, Auth0, Microsoft Entra ID, Google, GitHub, and other Identity Providers.

For modern public clients such as mobile and SPA applications, this flow is commonly combined with PKCE (Proof Key for Code Exchange).

Q1. What is the Authorization Code Flow?

Answer

Authorization Code Flow is an OAuth2 authorization flow where the client application first receives an Authorization Code, then exchanges it for an Access Token.

Unlike older flows, the Access Token is never exposed through the browser URL.

Authorization Code Flow

flowchart LR

User --> Client

Client --> AuthorizationServer

AuthorizationServer --> AuthorizationCode

AuthorizationCode --> Client

Client --> AccessToken

AccessToken --> ResourceServer

Benefits

  • Secure
  • Industry standard
  • Supports Refresh Tokens
  • Prevents password sharing

Q2. Why is Authorization Code Flow considered secure?

Answer

Instead of directly returning an Access Token, the Authorization Server first returns an Authorization Code.

The Client securely exchanges this code for an Access Token over a back-channel.

Secure Flow

flowchart TD

User --> Login

Login --> AuthorizationCode["Authorization Code"]

AuthorizationCode["Authorization Code"] --> BackendServer["Backend Server"]

BackendServer["Backend Server"] --> AccessToken["Access Token"]

Advantages

  • Access Token never appears in the browser URL.
  • Tokens are exchanged securely.
  • Better protection against token leakage.

Q3. What are the steps involved in Authorization Code Flow?

Answer

The flow consists of six major steps:

  1. User requests login.
  2. Client redirects to Authorization Server.
  3. User authenticates.
  4. Authorization Server returns Authorization Code.
  5. Client exchanges the code for an Access Token.
  6. Client accesses protected APIs.

Complete Flow

sequenceDiagram
participant User
participant Client
participant AuthorizationServer
participant ResourceServer
User->>Client: Login
Client->>AuthorizationServer: Authorization Request
AuthorizationServer-->>User: Login Page
User->>AuthorizationServer: Authenticate
AuthorizationServer-->>Client: Authorization Code
Client->>AuthorizationServer: Exchange Code
AuthorizationServer-->>Client: Access Token
Client->>ResourceServer: Access Token
ResourceServer-->>Client: Protected Resource

Q4. What is an Authorization Code?

Answer

An Authorization Code is a temporary code issued by the Authorization Server after successful user authentication.

Characteristics:

  • Short-lived
  • One-time use
  • Exchanged for Access Token
  • Cannot access APIs directly

Authorization Code Lifecycle

flowchart LR

UserLogin["User Login"] --> AuthorizationCode["Authorization Code"]

AuthorizationCode["Authorization Code"] --> AccessToken["Access Token"]

AccessToken["Access Token"] --> ProtectedApi["Protected API"]

Q5. What is the role of the Authorization Server?

Answer

The Authorization Server performs several responsibilities.

  • Authenticate User
  • Obtain User Consent
  • Generate Authorization Code
  • Issue Access Token
  • Issue Refresh Token

Authorization Server

flowchart TD

User --> AuthorizationServer["Authorization Server"]

AuthorizationServer["Authorization Server"] --> AuthorizationCode["Authorization Code"]

AuthorizationServer["Authorization Server"] --> AccessToken["Access Token"]

AuthorizationServer["Authorization Server"] --> RefreshToken["Refresh Token"]

Examples

  • Keycloak
  • Okta
  • Auth0
  • Microsoft Entra ID
  • Google Identity Platform

Q6. What is the role of the Client Application?

Answer

The Client Application is responsible for:

  • Redirecting the user
  • Receiving the Authorization Code
  • Exchanging the code for an Access Token
  • Calling protected APIs

Client Responsibilities

flowchart LR

Client --> AuthorizationRequest["Authorization Request"]

AuthorizationRequest["Authorization Request"] --> AuthorizationServer["Authorization Server"]

AuthorizationServer["Authorization Server"] --> AuthorizationCode["Authorization Code"]

AuthorizationCode["Authorization Code"] --> Client

Client --> ProtectedApi["Protected API"]

Q7. What is PKCE and why is it important?

Answer

PKCE (Proof Key for Code Exchange) enhances the Authorization Code Flow by protecting against authorization code interception.

It is recommended for:

  • Mobile Apps
  • Single Page Applications (SPA)
  • Public Clients

PKCE Flow

flowchart LR

Client --> CodeVerifier["Code Verifier"]

CodeVerifier["Code Verifier"] --> AuthorizationServer["Authorization Server"]

AuthorizationServer["Authorization Server"] --> AuthorizationCode["Authorization Code"]

AuthorizationCode["Authorization Code"] --> CodeChallengeVerification["Code Challenge Verification"]

CodeChallengeVerification["Code Challenge Verification"] --> AccessToken["Access Token"]

Benefits

  • Prevents authorization code theft
  • Protects public clients
  • Recommended by OAuth2 Security Best Practices

Q8. What are common mistakes in Authorization Code Flow?

Answer

Common mistakes include:

  • Not using HTTPS
  • Long-lived Access Tokens
  • Missing state parameter
  • Ignoring PKCE for public clients
  • Hardcoded Client Secret
  • Missing token validation
  • Weak redirect URI validation

Wrong Design

Authorization Code

↓

Browser Stores Token ❌

Correct Design

Authorization Code

↓

Backend Exchanges Code

↓

Access Token ✅

Q9. How is Authorization Code Flow implemented in Spring Security?

Answer

Spring Security supports Authorization Code Flow using OAuth2 Client.

Spring Architecture

flowchart TD

User --> SpringBootClient["Spring Boot Client"]

SpringBootClient["Spring Boot Client"] --> SpringAuthorizationServer["Spring Authorization Server"]

SpringAuthorizationServer["Spring Authorization Server"] --> JwtAccessToken["JWT Access Token"]

JwtAccessToken["JWT Access Token"] --> SpringResourceServer["Spring Resource Server"]

SpringResourceServer["Spring Resource Server"] --> RestApis["REST APIs"]

Spring Components

  • Spring Security
  • Spring Authorization Server
  • OAuth2 Client
  • Resource Server
  • JWT Decoder

Q10. What are the enterprise best practices for Authorization Code Flow?

Answer

Follow these best practices:

  • Always use HTTPS.
  • Use Authorization Code Flow for confidential clients.
  • Use Authorization Code Flow with PKCE for public clients.
  • Validate the state parameter to prevent CSRF.
  • Use short-lived Access Tokens.
  • Securely store Refresh Tokens.
  • Validate redirect URIs.
  • Rotate Refresh Tokens where supported.
  • Monitor authentication events.
  • Combine OAuth2 with OpenID Connect for user identity.

Enterprise OAuth2 Architecture

flowchart TD

User --> IdentityProvider["Identity Provider"]

IdentityProvider["Identity Provider"] --> AuthorizationServer["Authorization Server"]

AuthorizationServer["Authorization Server"] --> AuthorizationCode["Authorization Code"]

AuthorizationCode["Authorization Code"] --> SpringBootClient["Spring Boot Client"]

SpringBootClient["Spring Boot Client"] --> JwtAccessToken["JWT Access Token"]

JwtAccessToken["JWT Access Token"] --> ApiGateway["API Gateway"]

ApiGateway["API Gateway"] --> SpringBootApis["Spring Boot APIs"]

Authorization Code Flow Summary

mindmap
  root((Authorization Code Flow))
    Authorization Code
    Access Token
    Refresh Token
    PKCE
    HTTPS
    State Parameter
    Redirect URI
    Spring Security

Senior Interview Tip

The Authorization Code Flow is the preferred OAuth2 flow for enterprise applications because it provides strong security and supports Refresh Tokens.

Typical enterprise architecture:

  • User Authentication → OpenID Connect
  • Authorization → OAuth2 Authorization Code Flow
  • User Identity → JWT
  • API Protection → Spring Resource Server
  • API Entry Point → API Gateway
  • Internal Communication → mTLS
  • Continuous Verification → Zero Trust Architecture

For mobile apps and SPAs, always use Authorization Code Flow with PKCE.

Quick Revision

  • Authorization Code Flow is the recommended OAuth2 flow.
  • The Authorization Code is exchanged for an Access Token.
  • Access Tokens are never returned directly through the browser URL.
  • Authorization Codes are short-lived and single-use.
  • PKCE protects against authorization code interception.
  • Always use HTTPS.
  • Validate the state parameter.
  • Protect redirect URIs.
  • Use Refresh Tokens securely.
  • Combine Authorization Code Flow with OpenID Connect and JWT in enterprise applications.