Advanced

Handing over access safely

I sent the user's password to a third-party app to let it read their data. An access flow hands a scoped token instead, so the app never sees the password.

What you will see

{"access_token": "abc"}

About 1 min of reading

Try It

Trade a code for a scoped token on the server.

Exchange the code for a token server-side, where your secret lives.

curl -s -X POST -d 'code=xyz&client_secret=$SECRET' https://provider/token

Before you run it, say out loud what it will print. Then open the answer.

What it prints

{"access_token": "abc", "scope": "read:data", "expires_in": 3600}

A public client adds PKCE so an intercepted code cannot be traded by others.

curl -s -X POST -d 'code=xyz&code_verifier=$V' https://provider/token

Before you run it, say out loud what it will print. Then open the answer.

What it prints

{"access_token": "abc"}

Never do the code-to-token exchange in the browser. The browser has no secret, so an intercepted code becomes a token anyone can mint. Exchange on the server, or use PKCE for public clients.

Data Flow

The user consents, a code returns, and only the server (with its secret, or a PKCE verifier) trades the code for a scoped short-lived token; the password never travels.

1 User consents

↓

2 Code returns to you

↓

3 Server trades code for token

↓

4 Token is scoped and short

Why this works

Token, not credential

Delegating access means exchanging a short code for a scoped, short-lived token, done on the server where your secret lives. The third party holds a token it can revoke, never the account password.

PKCE for public clients

A browser or mobile app cannot keep a secret, so it uses PKCE: a random verifier only it knows ties the code exchange to the same client. Without it, an intercepted code can be traded for a token by anyone.

Examples

Never pass the password

WRONG: give the app the user's email + password

Handing a password gives full account access and the app stores it. A token gives scoped, revocable access to one thing.

The code exchange

1. redirect user to consent
2. user approves, you get a code
3. exchange code for a token (server side)

The code is useless without your secret, so the token is minted where only you can, never in the browser.

Scope and revoke

scope=read:data   expires=1h

Ask for the smallest scope and a short expiry. A stolen token reads one thing for one hour, then dies. A password is forever.

Words this lesson uses

Each one is defined here on this site. Open the entry for the full definition and the other words it points at.

← Locking what the page may load

Previous Lesson

Locking what the page may load

Next Lesson

Injection beyond the page

Injection beyond the page →